防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ lFJ~Cn  
wZ?`/p`Y  
试试这两种方法: XLjv$wsm  
第一种： qbCRusrt  
squery=lcase(Request.ServerVariables("QUERY_STRING")) 2$*u ej  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) )=@P[lH  
;=mT5jkM  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" psr!rGM  
!h0]z<lXE  
SQL_inj = split(SQL_Injdata,"|") Y XeEas^~  

1"j5'#Q  
For SQL_Data=0 To Ubound(SQL_inj) 6N6(#*  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then $]jD%O'V  
Response.Write "SQL通用防注入系统" B,i0 \(-,  
Response.end 8hEc"}'c\  
end if E[xJ/rM  
next .|\TI?-_A  
3{q>kEg?  
I;6*EpP<a  
GFbv
D  
第二种： q=b)T{B4  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" %s Fkd-<  
:HW/K&I  
SQL_inj = split(SQL_Injdata,"|") 4L5
2 O.  
!'[G`g\C!  
If Request.QueryString<>"" Then U\t,;  
For Each SQL_Get In Request.QueryString GN^W
q3Q_  
For SQL_Data=0 To Ubound(SQL_inj) @#_pM>  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then err NJa  
Response.Write "SQL通用防注入系统" 05|)?w,`I  
Response.end O(R&4bG  
end if sH/"Vw/ V  
next 9.0Lg!  
Next lJm"H<H`  
End If xV,1%jZ W  
FT5)P[\f  
If Request.Form<>"" Then Gx`ieT0  
For Each Sql_Post In Request.Form XtA_w{ya  
For SQL_Data=0 To Ubound(SQL_inj) aR4LF  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then Yh79$'dcb  
Response.Write "SQL通用防注入系统" [$kq3BK  
Response.end L$8L^D8h  
end if \-ol\Edr_  
next oA[}U_  
next ^/7.u7` !  
end if OwQ83!CC  
Q3=,evbMu\  
第三种 O;B&zk->  
<% S1A1%}pm\$  
'--------定义部份------------------ ~]
xxO_nq  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr #.0SE?%  
'自定义需要过滤的字串,用 "■"分离 4V xTcIv_  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" (W?NiA31  
'---------------------------------- 7`_&1A!L  
%> 0-5.k7`%
 
=AOW,oxn  
<% {
g}'%a  
Str_Inf = split(Str_In,"■") }Ls^sWY  
'--------POST部份------------------  GSw
 
If Request.Form<>"" Then 8+ntS"+m  
For Each Str_Post In Request.Form !D@cIb
 
AA 1 U*  
For Str_Xh=0 To Ubound(Str_Inf) qPZ1Jf Z  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then ch-dt5  
'--------写入数据库----------头----- l`W3|QM  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" Ln w^ad  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") }Y4Zy<  
Str_db.open Str_dbstr R^S(_:  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") WL>` ibs  
Str_db.close L<f B  
Set Str_db = Nothing E T&<X&BV  
'--------写入数据库----------尾----- |
U\\\  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" k /qrIrs  
Response.Write "非法操作！系统做了如下记录:<br>" 5L9r?%0  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" }g~P8z  
Response.Write "操作时间："&Now&"<br>" 61s9Qt%!  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ZD~\rN  
Response.Write "提交方式：POST<br>" I*.1~Z  
Response.Write "提交参数："&Str_Post&"<br>" vMn4qfscw  
Response.Write "提交数据："&Request.Form(Str_Post) xC_Wh5Kh  
Response.End +N#n.,@  
End If CALHjhIS  
Next VRYDZyf!d  
6?W{a1J  
Next 2tJv|
 D  
End If &Z,`aqlf(  
'---------------------------------- $c{Kx]nrM  
F)Bs.cf  
'--------GET部份------------------- \p{$  
If Request.QueryString<>"" Then  }xl4xUP  
For Each Str_Get In Request.QueryString oM v{Rd  
lX1)>d d  
For Str_Xh=0 To Ubound(Str_Inf) ,b/n{h't  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then %smOt2Pks  
'--------写入数据库----------头----- ?}?_Ss  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" pEg+b C  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") \8\!R0i  
Str_db.open Str_dbstr [LoQL`g3g  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") \#O s?6h  
Str_db.close WiU>Y  
Set Str_db = Nothing RE?,-`Xt+  
'--------写入数据库----------尾----- jd<Y /A  
[7\cP-}  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" ^LdL/a1d  
Response.Write "非法操作！系统做了如下记录:<br>" 'mNZPPhL  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" A3*fPqc1  
Response.Write "操作时间："&Now&"<br>" &\|Yo"z~I\  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" I1GO=G\  
Response.Write "提交方式：GET<br>" 3`K/~N,  
Response.Write "提交参数："&Str_Get&"<br>" !U%y!}^P  
Response.Write "提交数据："&Request.QueryString(Str_Get) qg[~ VynY  
Response.End Z|ox{ h>  
End If Ia40'G;\  
Next !|v)\jpR  
Next <3KiH%q  
End If piPc{  
%>  {'ii:7_  
第3中方法需要你自己建个数据库表