防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ z j[/~I  
LTSoo.dE  
试试这两种方法: !W^b:qjJ  
第一种： _t9@ vVQ  
squery=lcase(Request.ServerVariables("QUERY_STRING")) |~6X: M61  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) i]qVT)j  
z / YF7wrx  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" y093-  
=z=$S]qN  
SQL_inj = split(SQL_Injdata,"|") >9h@Dj[|!  
dWg09sx  
For SQL_Data=0 To Ubound(SQL_inj) Cfz020u`g  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then Z(' iZ'55F  
Response.Write "SQL通用防注入系统" /1h 0l;  
Response.end AqD)2O{VO  
end if >:2Br(S  
next E0g` xf6c  

7DG{|%\HF  
<($'jlZ  
(|(#W +l~  
第二种： ;bC163[  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" %J_`-\)"{~  
C2 ~ t  
SQL_inj = split(SQL_Injdata,"|") W?*]'0  
s@WF[S7D  
If Request.QueryString<>"" Then p@/i e@DX  
For Each SQL_Get In Request.QueryString hx'p0HDta  
For SQL_Data=0 To Ubound(SQL_inj) FIB 9W@oao  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then T'n~QfU  
Response.Write "SQL通用防注入系统" 3EM=6\#q  
Response.end \~3g*V  
end if ws{2 0  
next RV*7?y%3  
Next LLa72HW  
End If 8T}Ycm5}  
0K0[mC}ZwM  
If Request.Form<>"" Then e``X6=rcG  
For Each Sql_Post In Request.Form U\_-GS;1  
For SQL_Data=0 To Ubound(SQL_inj) h4j{44MT  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then h{dR)#)GF<  
Response.Write "SQL通用防注入系统" 5<?O S &B  
Response.end > xc7Hr~  
end if d[b(+sHp a  
next z[7j`J|Kk  
next T8ga) BA  
end if >&1
MD}  
O<@S,/Q4  
第三种 
8z?q4  
<% !,f#oCL  
'--------定义部份------------------ 9M$=X-  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr OOa}+^-j  
'自定义需要过滤的字串,用 "■"分离 XT n`$} nz  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" {}vB #!  
'---------------------------------- /uTU *Oe  
%> J9tQ@3{f  
,ZVC
@P,L  
<% L5E|1T  
Str_Inf = split(Str_In,"■") dkz79G}e  
'--------POST部份------------------ ;NyX9&@  
If Request.Form<>"" Then sj)$o94=  
For Each Str_Post In Request.Form ~S\Ee 2e>  
kW'xuZ&  
For Str_Xh=0 To Ubound(Str_Inf) |j[=uS  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then 7~t,Pt)  
'--------写入数据库----------头----- mOLP77(o  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ?A[q/n:K  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") lP4A?J+Q  
Str_db.open Str_dbstr E(5'vr0  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") -Qs4s  
Str_db.close \= M*x  
Set Str_db = Nothing N8<Wm>GLX~  
'--------写入数据库----------尾----- l9U^[;D  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" '
>GZB
 
Response.Write "非法操作！系统做了如下记录:<br>" 1>JUI5 {  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" p4\r`  
Response.Write "操作时间："&Now&"<br>" sknta0^=2  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" .?gpIZv  
Response.Write "提交方式：POST<br>" l?+67cQLA  
Response.Write "提交参数："&Str_Post&"<br>" G8m:]!  
Response.Write "提交数据："&Request.Form(Str_Post) \]uo^@$bm  
Response.End $
)L=MEdx  
End If OygR5s +  
Next mN_KAln  
0;*1g47\  
Next \6UK:'5{  
End If ls(lL\  
'----------------------------------
}CR@XD}[  
Q%.V\8#|V  
'--------GET部份------------------- |.A# wjF9  
If Request.QueryString<>"" Then w8|38m  
For Each Str_Get In Request.QueryString E^I |%F  
3NEbCILF  
For Str_Xh=0 To Ubound(Str_Inf) A4}6hG#  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then % ;SOe 9  
'--------写入数据库----------头----- REyk,s2"6  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" `|p3@e  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") KL2#Bm_  
Str_db.open Str_dbstr vd@_LcK  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") T.1*32cX  
Str_db.close P= e3f(M2  
Set Str_db = Nothing hf2Q;n&V  
'--------写入数据库----------尾-----
!nQ!J+ g  
4g}eqW  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" L*2YA IG  
Response.Write "非法操作！系统做了如下记录:<br>" %p5%Fs`sd  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ] ~;x$Z)  
Response.Write "操作时间："&Now&"<br>" we<m%pf  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" -t92!O  
Response.Write "提交方式：GET<br>" I8|7~jRB  
Response.Write "提交参数："&Str_Get&"<br>" &dqC =oK]  
Response.Write "提交数据："&Request.QueryString(Str_Get) !N6/l5kn  
Response.End hOI|#(
-  
End If  ~ccwu  
Next 3y}0J  @  
Next &zl=}xeA  
End If l;4},N  
%> /V66P@[>  
第3中方法需要你自己建个数据库表