防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ %0y_WIjz  
y-.<iq  
试试这两种方法: 51sn+h<w  
第一种： r5>1n/+6  
squery=lcase(Request.ServerVariables("QUERY_STRING")) y7X2|$9z-  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) 8q}955Nl  
K*QRi/O  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" ><&>JgM  
~K7$ZM  
SQL_inj = split(SQL_Injdata,"|") wr) \G
J#>  
SsY:gp_  
For SQL_Data=0 To Ubound(SQL_inj) H Q_IQ+  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then q6]T;)U&  
Response.Write "SQL通用防注入系统" 9I|D"zXn  
Response.end (XU(e  
end if J,W<vrKOcN  
next ?@>PKUv{  
b] 5i`  
0xEr`]]U  
D\4pLm"!v  
第二种： j5Cf\*B4J  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" _9pcHhJux  
1_=I\zx(  
SQL_inj = split(SQL_Injdata,"|") -4;$NiB?  
k#oe:u
`<  
If Request.QueryString<>"" Then B7 #O>a  
For Each SQL_Get In Request.QueryString oAxRI+&|.  
For SQL_Data=0 To Ubound(SQL_inj) O>KrTK-A
V  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then j*6>{_[  
Response.Write "SQL通用防注入系统" T4JG5  
Response.end @'~7O4WH  
end if 2]UwIxzR  
next +~7x+6E  
Next 4#Bzq3,|  
End If _;!$1lM[  
Jv8JCu"eky  
If Request.Form<>"" Then ns&3Dh(IVP  
For Each Sql_Post In Request.Form @'>Ul!.]  
For SQL_Data=0 To Ubound(SQL_inj) znkc@8_4  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then Fd1t/B,  
Response.Write "SQL通用防注入系统" KHTRoXt  
Response.end YXlaE=9bn  
end if H#+2l?D:"  
next L=_ 
  
next \z8j6 h  
end if {hH8+4c7  
3nbTK3,  
第三种 Bo4MoSF}  
<% 0^25uAD=  
'--------定义部份------------------ \dHdL\f  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr hN U.y
 
'自定义需要过滤的字串,用 "■"分离 r+W;}nyf  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" <1pRAN0  
'---------------------------------- 6N#0D2~^  
%> oG$OZTc  
Nf^6t1se  
<% d(_;@%p1X  
Str_Inf = split(Str_In,"■") i"h~QEE  
'--------POST部份------------------ ]=%oBxWAP  
If Request.Form<>"" Then M/abd 7q  
For Each Str_Post In Request.Form Y(<(!TJ-  
sPP(>y( \  
For Str_Xh=0 To Ubound(Str_Inf) wqasI@vyu  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then M*<Bp   
'--------写入数据库----------头----- F5YHc$3^  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" cE3V0voSw1  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ?
W2Wy\  
Str_db.open Str_dbstr )B5(V5-!|  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") giu8EjzK  
Str_db.close c\N-B,m&  
Set Str_db = Nothing lKLb\F%  
'--------写入数据库----------尾----- |&\cr\T\r  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" W4rh7e4  
Response.Write "非法操作！系统做了如下记录:<br>" G-G\l?R(  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" {>zQW{!  
Response.Write "操作时间："&Now&"<br>" J85Kgd1 \a  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ~.TKzh'eB  
Response.Write "提交方式：POST<br>" (d}z>?L  
Response.Write "提交参数："&Str_Post&"<br>" cB2jf</  
Response.Write "提交数据："&Request.Form(Str_Post) RRJ
N@|"  
Response.End Y[`%j\=  
End If @EGUQ|WL^  
Next  4d )Q  
I.'sK9\Zp  
Next SkMBdkS9z[  
End If 'sN (=CQ  
'---------------------------------- L`0}wR?+  
e(EXQP2P>  
'--------GET部份------------------- .6y(ox|LL  
If Request.QueryString<>"" Then )!C|DSw  
For Each Str_Get In Request.QueryString a+p_47 xa  
)jaNFJ 3  
For Str_Xh=0 To Ubound(Str_Inf) -%g{{'9B  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then "(^1Dm$(  
'--------写入数据库----------头----- |p @,]cz  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" OojQG  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") Xd@x(T~'X  
Str_db.open Str_dbstr M{M?#Q  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") P:
tl)ob  
Str_db.close
5wGc"JHm  
Set Str_db = Nothing 6l?\iE  
'--------写入数据库----------尾----- @
P xX]e  
6ZwFU5)QE/  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" w\Bx=a>vc  
Response.Write "非法操作！系统做了如下记录:<br>" h&6t.2<e  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 6)D
p2  
Response.Write "操作时间："&Now&"<br>" a?ii)GGq  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" #>(h!lT_  
Response.Write "提交方式：GET<br>" jthGNVZ  
Response.Write "提交参数："&Str_Get&"<br>" m~ l[Y  
Response.Write "提交数据："&Request.QueryString(Str_Get) XCku[?Ix  
Response.End UY*[='l!)  
End If .5YIf~!59  
Next uY*|bD`6&  
Next 4I<U5@a  
End If ]{E
{ IW8  
%> D4W^{/S  
第3中方法需要你自己建个数据库表