防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ MVvBd3  
5}]+|d;  
试试这两种方法: <`; {gX1  
第一种： % C2Vga#  
squery=lcase(Request.ServerVariables("QUERY_STRING")) ly6zz|c5  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) VX8CEO  
A9K$:mL<2  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" g:y4C6b  
PO6yEr  
SQL_inj = split(SQL_Injdata,"|") lfC]!=2%~8  
?(K=du  
For SQL_Data=0 To Ubound(SQL_inj) Q
#qfuwz  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then =l* xM/S  
Response.Write "SQL通用防注入系统" >ZG$8y 'j  
Response.end 9"gu>  
end if 2@2d |  
next em 0Y'J  
1%N*GJlwJ  
?vAhDD5  
uSQ#Y^V_  
第二种： 7'i{JPm  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"  oS9Od8  
LK
}FI*A_  
SQL_inj = split(SQL_Injdata,"|") 4\v &8">LL  
vS0 ii  
If Request.QueryString<>"" Then Gs3V]qbEP  
For Each SQL_Get In Request.QueryString CyYr5 D z  
For SQL_Data=0 To Ubound(SQL_inj) il!B={  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then L)F4)VL  
Response.Write "SQL通用防注入系统" .43cI(  
Response.end q jc4IW t~  
end if ,~ZD"'*n6g  
next D^.  c:  
Next NjEi.]L*fX  
End If ug ;Xoh5w  
G
xG~J4  
If Request.Form<>"" Then '#LzQ6Pn  
For Each Sql_Post In Request.Form ZBY2,%nAo  
For SQL_Data=0 To Ubound(SQL_inj) @d 7V@F0d  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then (Ll'j0]k>  
Response.Write "SQL通用防注入系统" *kqC^2t  
Response.end E JuTv%Y8  
end if AL3iNkEa  
next LOfw #+]d  
next   P3|s}&  
end if _]4p51r0  
kln)7SzPuk  
第三种 a oU"  
<% C&vi7Yx  
'--------定义部份------------------ sr&W+4T  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr 81s }4  
'自定义需要过滤的字串,用 "■"分离 EUcD[ Rv  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" ]2)A/fOW  
'---------------------------------- Q#SQ@oUzD  
%> -q{N1?tcy  
\DZ .#=d  
<% R3|4|JlGR  
Str_Inf = split(Str_In,"■") ycc G>%>r  
'--------POST部份------------------ LAf#Rco4  
If Request.Form<>"" Then C7NSmZ  
For Each Str_Post In Request.Form
7(.Z8AO  
N=2T~M 1  
For Str_Xh=0 To Ubound(Str_Inf) /R=MX>JA;  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then , %z HykP  
'--------写入数据库----------头----- FV "pJ  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" -NN=(p!<  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") &Q?@VNi  
Str_db.open Str_dbstr ([<HFc`  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") S}% z0g<  
Str_db.close jUA~}DVD  
Set Str_db = Nothing si6CWsb_f  
'--------写入数据库----------尾----- b1 w@toc  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" =ejU(1 g  
Response.Write "非法操作！系统做了如下记录:<br>" c5WMN.z  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ~i%=1&K&`  
Response.Write "操作时间："&Now&"<br>" S5 q
1Mn  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ( uD^_N]3  
Response.Write "提交方式：POST<br>" jmr .gW  
Response.Write "提交参数："&Str_Post&"<br>" Fk3(( n=  
Response.Write "提交数据："&Request.Form(Str_Post) A<)n H=G&  
Response.End U0j>u*yE  
End If 0N>K4ho6{  
Next ,k4pW&A  
L7 }nmP>aR  
Next ")uKDq  
End If C&w0HoF  
'---------------------------------- L>sL b(2\i  
f- 9t  
'--------GET部份------------------- e~lFjr]  
If Request.QueryString<>"" Then @y;VV*  
For Each Str_Get In Request.QueryString t7F0[E'=5\  
!X-\;3kC0  
For Str_Xh=0 To Ubound(Str_Inf) QNMZR  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then |@JTSz*Or  
'--------写入数据库----------头----- uM[|>t  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" @s-P!uCaT  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") nahq O|~  
Str_db.open Str_dbstr iXnXZ|M  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") )>FAtE   
Str_db.close S^pb9~  
Set Str_db = Nothing mv8H:T  
'--------写入数据库----------尾----- '1b 1N5~  
,6g{-r-2  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" > U?\WgE$  
Response.Write "非法操作！系统做了如下记录:<br>" Nz`8)
Le  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" (?1$  
Response.Write "操作时间："&Now&"<br>" :Pdh##k  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" /OztkThx=  
Response.Write "提交方式：GET<br>" J2VPO n  
Response.Write "提交参数："&Str_Get&"<br>" ?Xypn#OPt  
Response.Write "提交数据："&Request.QueryString(Str_Get) V[/9?5pM  
Response.End NzQvciJ@"  
End If kb2C9<
  
Next qK%N{ro[{?  
Next Opu*i  
End If }=bzUA`C  
%> [#gm[@d,  
第3中方法需要你自己建个数据库表