防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ m2
j&v$  
Xup"gYTZQ  
试试这两种方法: F@+FXnz  
第一种： L)0j&  
squery=lcase(Request.ServerVariables("QUERY_STRING")) **].d;~[l  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) )#NT*@j`  
}ZP;kM$g  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" BqF%2{  
V l, V  
SQL_inj = split(SQL_Injdata,"|") sYt\3/yL'  
QT!! KT f  
For SQL_Data=0 To Ubound(SQL_inj) R]s\s[B  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then XN*?<s3  
Response.Write "SQL通用防注入系统" Rh=,]Y  
Response.end ;w\7p a  
end if Sr9)i8x{  
next I04GQq l  
X=sC8Edx  
s>pOfXIx  
CG`s@5y>5  
第二种： BA1|%:.   
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" PT`];C(he  
_kgGz@/p  
SQL_inj = split(SQL_Injdata,"|") ?0ezr[`.  
H(MCY3t  
If Request.QueryString<>"" Then ~^6[SbVb  
For Each SQL_Get In Request.QueryString R<5GG|( B  
For SQL_Data=0 To Ubound(SQL_inj) 'aq9]D_k  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then CY"iP,nHl  
Response.Write "SQL通用防注入系统"
U}6FB =  
Response.end R')D~JJ<8a  
end if 72YL   
next 7tEK&+H`  
Next SO~]aFoYt  
End If (%i)A$i6a  
Qh3V[br  
If Request.Form<>"" Then #/Ul W  
For Each Sql_Post In Request.Form !I7bxDzK$  
For SQL_Data=0 To Ubound(SQL_inj) I3{koI  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then Vy+%sG q"  
Response.Write "SQL通用防注入系统" ,>:   
Response.end 0v~Eu>Rg  
end if j.'Rm%@u  
next GaD]qeS-K  
next JTK0#+?  
end if `]+-z+  
B/iRR2h  
第三种 v7V.,^6+  
<% Mp8FYP jZ  
'--------定义部份------------------ P ~pC /z  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr T:/68b*H\:  
'自定义需要过滤的字串,用 "■"分离 v(ATbY75  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" j:J M v  
'---------------------------------- :X?bWxOJ  
%> Tb2Tb2C  
E yv|~D  
<% /7bIE!Cn  
Str_Inf = split(Str_In,"■") [P,/J$v^~  
'--------POST部份------------------ kpe7\nd=>  
If Request.Form<>"" Then !Q`vOVSUD  
For Each Str_Post In Request.Form :3
F
Je  
f;Iaf#V_  
For Str_Xh=0 To Ubound(Str_Inf) FUq>+U!Qu  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then np>RxiB^  
'--------写入数据库----------头----- Ar+<n 2;[  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" HjX!a29Wf  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") AADvk_R  
Str_db.open Str_dbstr %(EUZu2  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") :HJ@/s!J  
Str_db.close 5 M.KF;P  
Set Str_db = Nothing |bHId !d  
'--------写入数据库----------尾----- {29x5J  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" 1pUIZ$@?`  
Response.Write "非法操作！系统做了如下记录:<br>" 4z~%gt74O]  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" nvJ2V$  
Response.Write "操作时间："&Now&"<br>"  qep<7 QO  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" *kI1NchF  
Response.Write "提交方式：POST<br>" >%~E <  
Response.Write "提交参数："&Str_Post&"<br>" X j'7nj  
Response.Write "提交数据："&Request.Form(Str_Post) m&'z|eN  
Response.End Qx_K)  
End If  ?~mw  
Next [vIHYp  
/1Xji0LK  
Next v{R:F  
End If [M^ur%H  
'---------------------------------- P]H
cg|&  
~MvLrg"i  
'--------GET部份------------------- C ?
^si  
If Request.QueryString<>"" Then ,oW8im   
For Each Str_Get In Request.QueryString uq}>5  
\Z +O9T%  
For Str_Xh=0 To Ubound(Str_Inf) 9$9Pv%F:j  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then :QSCky*i  
'--------写入数据库----------头----- e[3r
z%'Q  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" w85PRruW  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 4_`ss+gk  
Str_db.open Str_dbstr IZ2c<B5&  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") Lv;R8^n  
Str_db.close Cq7EdK;x  
Set Str_db = Nothing >5i(U_`l  
'--------写入数据库----------尾----- G(alM=q  
y.zS?vv2g  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" u>G#{$)  
Response.Write "非法操作！系统做了如下记录:<br>" EW* 's(  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" #+1*g4m~B  
Response.Write "操作时间："&Now&"<br>" `_IgH  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ^JDiI7  
Response.Write "提交方式：GET<br>" 9s5PJj"u  
Response.Write "提交参数："&Str_Get&"<br>" VfJbexYT  
Response.Write "提交数据："&Request.QueryString(Str_Get) hM!D6: t  
Response.End EDm,Y  
End If  e3+'m  
Next P=)&]Pz  
Next D4:c)}  
End If 2?]NQE9lA  
%> d 83K;Ryd  
第3中方法需要你自己建个数据库表