防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ O1mKe%'|  
xZv#Es%#  
试试这两种方法: ?3xzd P  
第一种： Y UIi;   
squery=lcase(Request.ServerVariables("QUERY_STRING")) t<viX's  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) ;d9QAN&0}  
nj 53G67y  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" XvlU*TO~(~  
"FKOaQ%IH  
SQL_inj = split(SQL_Injdata,"|") &JI8]JmU)  
}AH] th  
For SQL_Data=0 To Ubound(SQL_inj) E\,
-XH  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then uRr o?m<  
Response.Write "SQL通用防注入系统" [zM- ^  
Response.end 7Rt9od< )!  
end if $p? aVO  
next UZsH9 o  
ZJ[ ??=Gz  
^ovR7+V  
`^y7f  
第二种： \K!VNB>h  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" C 6AUNRpl  
8pgEix/M5o  
SQL_inj = split(SQL_Injdata,"|") j,dR,Nd  
9 |vLwQ  
If Request.QueryString<>"" Then iW /}#  
For Each SQL_Get In Request.QueryString hfy_3}_  
For SQL_Data=0 To Ubound(SQL_inj) }!C)}.L<  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then d{7+w/Zi  
Response.Write "SQL通用防注入系统" {,~3.5u   
Response.end Per1
IcN  
end if H DFOA  
next 3kMf!VL  
Next w)Qp?k d  
End If ;BIY^6,7e  
A$:U'ZG_  
If Request.Form<>"" Then t1y4 7fX6  
For Each Sql_Post In Request.Form qeZ? 7#Gf  
For SQL_Data=0 To Ubound(SQL_inj) ~`:L?Jkb6H  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then #?9;uy<j.q  
Response.Write "SQL通用防注入系统" $H>W|9Kg,  
Response.end 4Wm@W E  
end if s}% M4  
next "!%l/_p?  
next fsWTF<Y  
end if C-[eaHJ'$  
hFl^\$Re  
第三种 =>af@C.2  
<% ITT@,  
'--------定义部份------------------ :A'y+MnK<  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr n#OB%@]<V  
'自定义需要过滤的字串,用 "■"分离 .=jay{  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" <<R*2b  
'---------------------------------- e;}7G  
%>
[mGLcg6Fw  
/CG"]!2 "  
<% o\<ULW*  
Str_Inf = split(Str_In,"■") ;|5F[  
'--------POST部份------------------ 5\sd3<:+  
If Request.Form<>"" Then Un(aW=PQ0  
For Each Str_Post In Request.Form }DEg-j,F  
WZejp}x  
For Str_Xh=0 To Ubound(Str_Inf) =Z3F1Cq?  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then bv9]\qC]T<  
'--------写入数据库----------头----- g ^2OkV(  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" C'@i/+  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") }6}l7x  
Str_db.open Str_dbstr N/'b$m5= S  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") yZ(zdM\/sL  
Str_db.close } FlT%>Gw  
Set Str_db = Nothing @=Uh',F  
'--------写入数据库----------尾----- d>&,9c%  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" D/B8tf+V  
Response.Write "非法操作！系统做了如下记录:<br>" @* jz o  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" |y# Jx  
Response.Write "操作时间："&Now&"<br>" Uq,^Wy  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" He/8=$c%  
Response.Write "提交方式：POST<br>" 5 +YH.4R  
Response.Write "提交参数："&Str_Post&"<br>" Mzw<{*:r  
Response.Write "提交数据："&Request.Form(Str_Post) B6nX$T4zP  
Response.End C12 Fl  
End If R'`qKc  
Next 2dcV"lY  
E`0 ?  
Next +z\^t_"f  
End If 9y8&9<#  
'---------------------------------- S6M}WR^,  
+nhLIO{{L  
'--------GET部份------------------- Mj?`j_X  
If Request.QueryString<>"" Then /-qNh>v4  
For Each Str_Get In Request.QueryString :&rt)/I  
k&q;JyUi  
For Str_Xh=0 To Ubound(Str_Inf) V)-+Fd,=  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then m6K}|j  
'--------写入数据库----------头----- '$IKtM`L  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" S_4?K)n #  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") =^f<v_L  
Str_db.open Str_dbstr FZ<gpIv!NS  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") UiP"Ixg6  
Str_db.close
o. g V4%  
Set Str_db = Nothing f#"J]p  
'--------写入数据库----------尾----- { Fb*&|-n  
n)e 6>R;  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" vHc%z$-d  
Response.Write "非法操作！系统做了如下记录:<br>" !r8
`Yrn  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" YQ)kRhFA  
Response.Write "操作时间："&Now&"<br>" TG?brgW  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" e/&{v8Hmb  
Response.Write "提交方式：GET<br>" ]BZA:dd.G  
Response.Write "提交参数："&Str_Get&"<br>" (ejvF):|  
Response.Write "提交数据："&Request.QueryString(Str_Get) &|ex`nwc0  
Response.End rgv?gaQ>  
End If l -mfFN  
Next {n.PF8A5X  
Next El".I?E*  
End If 9Cp-qA%t  
%> ;_I8^?d  
第3中方法需要你自己建个数据库表