防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ QNXoAx%I  
*U}-Y*  
试试这两种方法: X(BX+)YR  
第一种： {jv+ JL"5  
squery=lcase(Request.ServerVariables("QUERY_STRING")) *sau['Ha  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) 5$Kd<ky  
=l:k($%%  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" olr-oi`4C  
0$0 215  
SQL_inj = split(SQL_Injdata,"|") &8yGVi  
{{B'65Wu  
For SQL_Data=0 To Ubound(SQL_inj) ^Ku]8/ga  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then JLz32 %-M  
Response.Write "SQL通用防注入系统" j5og}P
q:  
Response.end zg'.fUZ  
end if `,]_r4~ ~  
next 0FLCN!i1  
YQtq?&0Ct  
$:# :"  
u'k+t`V&  
第二种： +o'xyR'(  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" a5aHv/W#P  
;Qi!~VsP;  
SQL_inj = split(SQL_Injdata,"|") ]O{i?tyX  
uF1&m5^W  
If Request.QueryString<>"" Then -ssmj8:Q\|  
For Each SQL_Get In Request.QueryString sSc~q+xz  
For SQL_Data=0 To Ubound(SQL_inj) 5;G 0$M0  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then FS=LpvOG)  
Response.Write "SQL通用防注入系统"  ^>>9?  
Response.end )\PX1198  
end if KUq7Oa!  
next ?|pP&8r  
Next 5%4yUd#b  
End If mU  
u+ hRaI;v  
If Request.Form<>"" Then R4T@ ]l&W  
For Each Sql_Post In Request.Form ^Bo'87!.  
For SQL_Data=0 To Ubound(SQL_inj) WnOvU<Z <  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then $|7=$~y  
Response.Write "SQL通用防注入系统" D?UURURf  
Response.end o4OB xHKy  
end if `(gQw~|z  
next *&\6x}.I4  
next sCP|d`'  
end if rA^=;?7Q  
:R3iLy  
第三种 Ujlbcv6+  
<% 3,`M\#z%K  
'--------定义部份------------------ gs7_Q  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr j8 `7)^  
'自定义需要过滤的字串,用 "■"分离 X y`2ux+>/  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" pQ!lY  
'---------------------------------- kM[!UOnC!<  
%> 8 R7w$3pp\  
_ker,;{9C  
<% p_%,J D  
Str_Inf = split(Str_In,"■") ?m+];SJk  
'--------POST部份------------------ zb4{nzX=  
If Request.Form<>"" Then ,G-  
For Each Str_Post In Request.Form RZKx!X4=q  
 (:o:_U  
For Str_Xh=0 To Ubound(Str_Inf) wnK6jMjkSf  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then [b&V^41W  
'--------写入数据库----------头----- ^*+M9e9Z  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" k}I65 ^l#  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") *D
XX*9 0  
Str_db.open Str_dbstr *M*WjEOA  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')")  CE!cZZ  
Str_db.close /hmDe
Po}  
Set Str_db = Nothing r> Xk1~<!  
'--------写入数据库----------尾----- k Jw Pd;%  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" Slj U=,  
Response.Write "非法操作！系统做了如下记录:<br>" PkZ1Db  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" J ]w3iYK  
Response.Write "操作时间："&Now&"<br>" MM*~X"A  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" _cC1u7U9  
Response.Write "提交方式：POST<br>" ]~Vu Y:abH  
Response.Write "提交参数："&Str_Post&"<br>" Nd_A8H,&B  
Response.Write "提交数据："&Request.Form(Str_Post) fI2y(p{?  
Response.End _~{J."q  
End If !`4ie  
Next _Pa@%/  
Hz[1c4)'F  
Next Iz83T9I&  
End If a(*"r:/lD  
'---------------------------------- n*' :,m  
tQYV4h\Qj  
'--------GET部份------------------- yP
e9KN_  
If Request.QueryString<>"" Then k@s<*C  
For Each Str_Get In Request.QueryString &<_q00F  
zUDXkG*Lv  
For Str_Xh=0 To Ubound(Str_Inf) mPqKk  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then -;ra(L`  
'--------写入数据库----------头----- ev D=]iVD  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ->
o[ S0  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") fAz4>_4  
Str_db.open Str_dbstr p&u\gSo  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") <;'{Tj-"  
Str_db.close L+T'TC:  
Set Str_db = Nothing \IYv9ScAx  
'--------写入数据库----------尾----- N 3O!8A_  
N6p
0`
 
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" +'iqGg-  
Response.Write "非法操作！系统做了如下记录:<br>" ZMr[:,Jp  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" #Ef!X  
Response.Write "操作时间："&Now&"<br>" {T,}]oX  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" Q4*{+$A  
Response.Write "提交方式：GET<br>" =S6bP< q  
Response.Write "提交参数："&Str_Get&"<br>" - US>].  
Response.Write "提交数据："&Request.QueryString(Str_Get) <P ?gP1_zi  
Response.End DfU= i'R  
End If [u=yl0f  
Next EYZ&%.Sy5  
Next iOCs%J  
End If 64'QTF{D  
%> p:$kX9mT&  
第3中方法需要你自己建个数据库表