防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ }@1LFZx
 
(:-DuUt  
试试这两种方法: G!0|ocE}  
第一种： _IT,> #ba  
squery=lcase(Request.ServerVariables("QUERY_STRING")) ,,fLK1  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) >6jyd{  
A{&Etu(K  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" RoJ&dK  
e|+uLbN&;c  
SQL_inj = split(SQL_Injdata,"|") w:z_EV!&  
6"&&s  
For SQL_Data=0 To Ubound(SQL_inj)  "thfd"-  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then a`/[\K6  
Response.Write "SQL通用防注入系统" f4@Dn >BJ  
Response.end nqiy)ZN#R  
end if 1DZ
Gb)OU  
next 6JK;]Ah  
4XX21<yn  
JhB{aW>  

MKoN^(7  
第二种： sI*( MhU  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" c!w4N5aM  
:V+t|@m5l  
SQL_inj = split(SQL_Injdata,"|") pjjs'A*y  
F!zZIaB]  
If Request.QueryString<>"" Then !B-&I E?  
For Each SQL_Get In Request.QueryString &,NHk9.aq  
For SQL_Data=0 To Ubound(SQL_inj) 1<bSHn9  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then Zh3]bg5  
Response.Write "SQL通用防注入系统" B<:i[~`7t  
Response.end _ogT(uYyr  
end if <;v{`@
\j{  
next  $JX_e  
Next I&1Mh4yu  
End If #i)h0ML/e  
#H
7(dT  
If Request.Form<>"" Then H~x0-q<8  
For Each Sql_Post In Request.Form :Tj,;0#/  
For SQL_Data=0 To Ubound(SQL_inj) !aLByMA  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then 1AoBsEnd  
Response.Write "SQL通用防注入系统" 6@Eip[e  
Response.end {/R4Q1  
end if ap;*qiNFQ  
next ^@{'! N  
next -#)xeW.d  
end if 7J$ ^R6rh  
T3M 4r|  
第三种 [DjdR_9*I  
<% H3`%#wQ0j  
'--------定义部份------------------ E.6^~'/  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr OP:;?Fs9`  
'自定义需要过滤的字串,用 "■"分离 #n~/~*:i92  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" ]!0*k#i_.  
'---------------------------------- d*q_DV  
%> u7a4taM$d  
sjShm  
<% nNBxT+3*i  
Str_Inf = split(Str_In,"■") eN}FBX#'  
'--------POST部份------------------ .bL{fBTT~  
If Request.Form<>"" Then C_'Ug  
For Each Str_Post In Request.Form {wA@5+[  
U%w-/!p  
For Str_Xh=0 To Ubound(Str_Inf) Fp@eb8Pl  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then 3z~zcQ^\  
'--------写入数据库----------头----- {yspNyOx  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" iW)FjDTP  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 3=;iC6 `  
Str_db.open Str_dbstr o Q{gh$6*  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") Q#:,s8TW[  
Str_db.close &Hh%pY"  
Set Str_db = Nothing I:mJWe   
'--------写入数据库----------尾----- eDTEy;^o  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" ~^Vt)/}Q  
Response.Write "非法操作！系统做了如下记录:<br>" U R@'J@V#:  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 3ck;~Ncj<  
Response.Write "操作时间："&Now&"<br>" AQ+w%>G6  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ^f3F~XhY3  
Response.Write "提交方式：POST<br>" ,YH^j c  
Response.Write "提交参数："&Str_Post&"<br>" m[Zz(tL  
Response.Write "提交数据："&Request.Form(Str_Post) N15{7,   
Response.End kFuaLEJi  
End If \Sm.]=br  
Next >@ge[MuS  
QD"V=}'?  
Next LX*T<|c`'  
End If n:k~\-&WJ  
'---------------------------------- ;=UrIA@y;=  
,`-6!|:  
'--------GET部份------------------- Q6
}`%
 
If Request.QueryString<>"" Then 3~Ipcr B  
For Each Str_Get In Request.QueryString zFQxW4G  
rBgLj,/`U/  
For Str_Xh=0 To Ubound(Str_Inf) Q&n
  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then 7/aJ?:gX  
'--------写入数据库----------头----- .bnoK  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" Z
H&%D*a&  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 299; N  
Str_db.open Str_dbstr TS=p8@w}  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") UN,@K9  
Str_db.close ;[dcbyu@  
Set Str_db = Nothing xx9qi^  
'--------写入数据库----------尾----- LZ\}Kgi(!T  
#( X4M{I  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" rJ!xzg
e;G  
Response.Write "非法操作！系统做了如下记录:<br>" eeB^c/k(P  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" v\\Z
[,dK  
Response.Write "操作时间："&Now&"<br>" GH
YgSS  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 7CwG(c/5  
Response.Write "提交方式：GET<br>" 5F <zW-;  
Response.Write "提交参数："&Str_Get&"<br>" U_M> Q_r(  
Response.Write "提交数据："&Request.QueryString(Str_Get) vK2L"e  
Response.End 7i6-Hq  
End If ,gkxZ{Eh  
Next JrCm >0g  
Next $i~DUT(  
End If =b9?r  
%> T4\,b  
第3中方法需要你自己建个数据库表