防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ ~h-G  
oQ!}@CaN|  
试试这两种方法: 6 .DJRY  
第一种： G-oCA1UdN  
squery=lcase(Request.ServerVariables("QUERY_STRING")) EK.L>3  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) &B3Eq1A  
G[u_Uu=>  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" ?!(/;RU1  
*|AnL}GJ  
SQL_inj = split(SQL_Injdata,"|") (\FjbY9&  
0O4'Ts ?  
For SQL_Data=0 To Ubound(SQL_inj) e1{t qNJ  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then xD#PM |I  
Response.Write "SQL通用防注入系统" IBl}.o&]B#  
Response.end s<0yQ-=.?N  
end if , 6\i  
next %_+9y??  
AF D/
J  
~
Av]LW  
l ,)l"6OV  
第二种： RLY Ae  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" W#'c6Hq2c  
"d'xT/l "  
SQL_inj = split(SQL_Injdata,"|") sBp|Lo  
9BLz  
If Request.QueryString<>"" Then <Xw 6m$fr:  
For Each SQL_Get In Request.QueryString Tp~yn  
For SQL_Data=0 To Ubound(SQL_inj) Cq1t[a  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then ~bT0gIc  
Response.Write "SQL通用防注入系统" n]4)~ZIAU  
Response.end d%9I*Qo0,  
end if S}e*~^1J  
next Q3%a=ba)h  
Next `u :U{m  
End If _5M!ec  
@FkNT~OZ  
If Request.Form<>"" Then IC[SJVH;  
For Each Sql_Post In Request.Form M4M 4*o  
For SQL_Data=0 To Ubound(SQL_inj) lsW.j#yE!  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then Y'/`?CK  
Response.Write "SQL通用防注入系统" 5WP[-J)  
Response.end R#tz"T@  
end if +YT/od1t7  
next $Z 10Zf=  
next 8s8q`_.)(  
end if L
Yh5f#  
/0SG  
第三种 M@!Gk  
<% 4q@o4C<0  
'--------定义部份------------------ O|,+@qtH  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr 3]'=s>UO>^  
'自定义需要过滤的字串,用 "■"分离 )ACa0V>*p  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" 5:|5NX[.b  
'---------------------------------- A4';((OXy  
%> #Vn=(U4}!_  
z1!ya#,$  
<% [gzU/:  
Str_Inf = split(Str_In,"■") &m8B%9w  
'--------POST部份------------------ -j3 - H&  
If Request.Form<>"" Then doc5;?6   
For Each Str_Post In Request.Form O~d !*A  
K1O/>dN_\O  
For Str_Xh=0 To Ubound(Str_Inf) 2 T{PIJg3  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then $qQ6u!  
'--------写入数据库----------头----- A#1aO  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" _1y|#o  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") X_s;j5ur  
Str_db.open Str_dbstr HAo8]?J
  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") $$ _uQf  
Str_db.close O,qR$#l   
Set Str_db = Nothing &:]_a?|*S  
'--------写入数据库----------尾----- dG7sY O@U  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" )2YU|  
Response.Write "非法操作！系统做了如下记录:<br>" F&lc8  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" oBqP^uT>a|  
Response.Write "操作时间："&Now&"<br>" PyYKeo=  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" B>X+eK  
Response.Write "提交方式：POST<br>" r_)-NOp  
Response.Write "提交参数："&Str_Post&"<br>" {KwLcSn  
Response.Write "提交数据："&Request.Form(Str_Post) sp O?5#  
Response.End TOMvJ>bF  
End If XP2=x_"y  
Next nq/xD;q  
(]1le|+  
Next Kox~k?JK  
End If l0D.7>aj  
'---------------------------------- ZM;EjS1  
>jl"Yr#  
'--------GET部份------------------- m)_1->K  
If Request.QueryString<>"" Then  4EB$e?  
For Each Str_Get In Request.QueryString (/"T=`3t  
e7#=F6  
For Str_Xh=0 To Ubound(Str_Inf) QH\*l~;B\  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then 9U}EVpD  
'--------写入数据库----------头----- u6r-{[W}  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" :Yz.Bfli  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") }T,E$vsx  
Str_db.open Str_dbstr D4#,9?us  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") & KR@2~vE  
Str_db.close 3pDZ}{ZZU  
Set Str_db = Nothing l'16B^  
'--------写入数据库----------尾----- =j;o, J:(  
AU'{aC+p  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" G#@<bg3  
Response.Write "非法操作！系统做了如下记录:<br>" w4L\@y3  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ^;@Bz~Z  
Response.Write "操作时间："&Now&"<br>" RB &s$6A  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 3;:xEPb._6  
Response.Write "提交方式：GET<br>" )0}obPp  
Response.Write "提交参数："&Str_Get&"<br>" 0l 3RwWj  
Response.Write "提交数据："&Request.QueryString(Str_Get) &u=FLp5  
Response.End ) ]~HjA;  
End If <Isr  
Next `SW`d<+L  
Next Q ;k_q3  
End If 38'H-]8q"  
%>  iI ^{OD  
第3中方法需要你自己建个数据库表