防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ ~OWpk)Vq  
L;WFHIE  
试试这两种方法: f@2F!  
第一种： \-SC-c  
squery=lcase(Request.ServerVariables("QUERY_STRING")) ~n$\[rQ  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) 7AlL,&+  
GI@;76Qf  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" %aV~RB#  
]FgKL0  
SQL_inj = split(SQL_Injdata,"|") P *&Cght>0  
l# ~pK6@W  
For SQL_Data=0 To Ubound(SQL_inj) hj}PL  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then Xzl$Qc  
Response.Write "SQL通用防注入系统" 4'TssRot@h  
Response.end U>sEFzBup  
end if WL?qulC}h1  
next ~E/=
nv$  
uPxJwWXO  
G[6i\Et  
7Ck3L6J#  
第二种： ZQ>Q=eCs 1  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 9Y@ eXP  
>.I9S{7  
SQL_inj = split(SQL_Injdata,"|") zp5ZZcj_  
o/ 7[ G  
If Request.QueryString<>"" Then {$#88Qa\-  
For Each SQL_Get In Request.QueryString J= &}$  
For SQL_Data=0 To Ubound(SQL_inj) B*t1Y<>x  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then |AT`(71  
Response.Write "SQL通用防注入系统" 4;Vi@(G)  
Response.end U1(cBY  
end if 10)RLh|+  
next z{&z  
Next W23Q>x&S  
End If }1%%`  
9kB R/{  
If Request.Form<>"" Then x4(8 =&Z  
For Each Sql_Post In Request.Form |QD#Dx1_  
For SQL_Data=0 To Ubound(SQL_inj) TY%=Y=  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then zXU g(xu  
Response.Write "SQL通用防注入系统" UB +7]S  
Response.end iXq*EZb"R  
end if _90<*{bt.  
next ahQY-%>  
next +z:>Nl  
end if :K5?&kT  
@|5B}%!  
第三种 mi.,Z`]o  
<% ]s!id[j
 
'--------定义部份------------------ q!W=U8`  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr v*&jA8D  
'自定义需要过滤的字串,用 "■"分离 3y,2RernK  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" "0,FB4L[U5  
'---------------------------------- {3.n!7+  
%> 9aNOfs8(  
o)>iHzR</  
<% c&N;r|N  
Str_Inf = split(Str_In,"■") UNK.39  
'--------POST部份------------------ &H P g>  
If Request.Form<>"" Then !zvOCAb,  
For Each Str_Post In Request.Form KMK8jJ  
5S,Kq35$(  
For Str_Xh=0 To Ubound(Str_Inf) 8&nb@l  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then P]TT8Jgw  
'--------写入数据库----------头----- BzS\p3&  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" I~^Xw7  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ~y?Nn8+&f  
Str_db.open Str_dbstr z>\l%_w  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") \<\H1;=.@'  
Str_db.close &]GR
*a  
Set Str_db = Nothing *X{7m]5  
'--------写入数据库----------尾----- IsShAi  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" W#E(?M[r  
Response.Write "非法操作！系统做了如下记录:<br>" 8a&c=9  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>"  wlsx|  
Response.Write "操作时间："&Now&"<br>" _/ 'VD!(MV  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" /.=aA~|  
Response.Write "提交方式：POST<br>" k5J18S  
Response.Write "提交参数："&Str_Post&"<br>" \I-e{'h  
Response.Write "提交数据："&Request.Form(Str_Post) tv
`b##  
Response.End 1X7GM65#  
End If '2hy%  
Next \#WWJh"W  
"}#% h&,  
Next .9WOTti  
End If Bs `{qmbC  
'---------------------------------- O9E:QN<U`*  
^<;CIXo  
'--------GET部份------------------- EpQy;#=;  
If Request.QueryString<>"" Then r>7+&s*yk  
For Each Str_Get In Request.QueryString $(+xhn(O  
K0>+-p oL  
For Str_Xh=0 To Ubound(Str_Inf) [ZC\8tP`V  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then ^)I}#  
'--------写入数据库----------头----- \uZ|2WG`  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" 0[M2LF!m  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") idGn{f((f  
Str_db.open Str_dbstr v|\#wrCT?  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") F\^8k/0  
Str_db.close 09trFj$L
 
Set Str_db = Nothing [f! { -T  
'--------写入数据库----------尾----- rfYa<M Qc  
,ms
P(*qoI  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" ?o$t{AQ  
Response.Write "非法操作！系统做了如下记录:<br>" c;Tp_e@  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" [3s-S +n @  
Response.Write "操作时间："&Now&"<br>" 9<&M~(dwT4  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" /e[m;+9^&  
Response.Write "提交方式：GET<br>" HA,8O[jon  
Response.Write "提交参数："&Str_Get&"<br>" R gUQ
:  
Response.Write "提交数据："&Request.QueryString(Str_Get) h#KSKKNW  
Response.End eY
'nS  
End If 1#%H!GKvTU  
Next ot[ZFF\  
Next pgiZA?r*<  
End If 2O*At%CzW  
%> U.
_fb=  
第3中方法需要你自己建个数据库表