网站防止SQL注入

妖狐艹你老母 2022-08-07 08:46 144阅读 0赞

第一种：  
squery=lcase(Request.ServerVariables("QUERY\_STRING"))  
sURL=lcase(Request.ServerVariables("HTTP\_HOST"))  
  
SQL\_injdata =":|;|>|<|--|sp\_|xp\_|/|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|\*|%|chr|mid|master|truncate|char|declare"  
  
SQL\_inj = split(SQL\_Injdata,"|")  
  
For SQL\_Data=0 To Ubound(SQL\_inj)  
if instr(squery&sURL,Sql\_Inj(Sql\_DATA))>0 Then  
Response.Write "SQL通用防注入系统"  
Response.end  
end if  
next  
  
  
  
第二种：  
SQL\_injdata =":|;|>|<|--|sp\_|xp\_|/|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|\*|%|chr|mid|master|truncate|char|declare"  
  
SQL\_inj = split(SQL\_Injdata,"|")  
  
If Request.QueryString<>"" Then  
For Each SQL\_Get In Request.QueryString  
For SQL\_Data=0 To Ubound(SQL\_inj)  
if instr(Request.QueryString(SQL\_Get),Sql\_Inj(Sql\_DATA))>0 Then  
Response.Write "SQL通用防注入系统"  
Response.end  
end if  
next  
Next  
End If  
  
If Request.Form<>"" Then  
For Each Sql\_Post In Request.Form  
For SQL\_Data=0 To Ubound(SQL\_inj)  
if instr(Request.Form(Sql\_Post),Sql\_Inj(Sql\_DATA))>0 Then  
Response.Write "SQL通用防注入系统"  
Response.end  
end if  
next  
next  
end if  
  
第三种  
<%  
'--------定义部份------------------  
Dim Str\_Post,Str\_Get,Str\_In,Str\_Inf,Str\_Xh,Str\_db,Str\_dbstr  
'自定义需要过滤的字串,用 "■"分离  
Str\_In = "'■;■and■exec■insert■select■delete■update■count■\*■%■chr■mid■master■truncate■char■declare"  
'----------------------------------  
%>  
  
<%  
Str\_Inf = split(Str\_In,"■")  
'--------POST部份------------------  
If Request.Form<>"" Then  
For Each Str\_Post In Request.Form  
  
For Str\_Xh=0 To Ubound(Str\_Inf)  
If Instr(LCase(Request.Form(Str\_Post)),Str\_Inf(Str\_Xh))<>0 Then  
'--------写入数据库----------头-----  
Str\_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER=\{Microsoft Access Driver (\*.mdb)\};"  
Set Str\_db=Server.CreateObject("ADODB.CONNECTION")  
Str\_db.open Str\_dbstr  
Str\_db.Execute("insert into SqlIn(Sqlin\_IP,SqlIn\_Web,SqlIn\_FS,SqlIn\_CS,SqlIn\_SJ) values('"&Request.ServerVariables("REMOTE\_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str\_Post&"','"&replace(Request.Form(Str\_Post),"'","''")&"')")  
Str\_db.close  
Set Str\_db = Nothing  
'--------写入数据库----------尾-----  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>"  
Response.Write "非法操作！系统做了如下记录:<br>"  
Response.Write "操作IP："&Request.ServerVariables("REMOTE\_ADDR")&"<br>"  
Response.Write "操作时间："&Now&"<br>"  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"  
Response.Write "提交方式：POST<br>"  
Response.Write "提交参数："&Str\_Post&"<br>"  
Response.Write "提交数据："&Request.Form(Str\_Post)  
Response.End  
End If  
Next  
  
Next  
End If  
'----------------------------------  
  
'--------GET部份-------------------  
If Request.QueryString<>"" Then  
For Each Str\_Get In Request.QueryString  
  
For Str\_Xh=0 To Ubound(Str\_Inf)  
If Instr(LCase(Request.QueryString(Str\_Get)),Str\_Inf(Str\_Xh))<>0 Then  
'--------写入数据库----------头-----  
Str\_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER=\{Microsoft Access Driver (\*.mdb)\};"  
Set Str\_db=Server.CreateObject("ADODB.CONNECTION")  
Str\_db.open Str\_dbstr  
Str\_db.Execute("insert into SqlIn(Sqlin\_IP,SqlIn\_Web,SqlIn\_FS,SqlIn\_CS,SqlIn\_SJ) values('"&Request.ServerVariables("REMOTE\_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str\_Get&"','"&replace(Request.QueryString(Str\_Get),"'","''")&"')")  
Str\_db.close  
Set Str\_db = Nothing  
'--------写入数据库----------尾-----  
  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>"  
Response.Write "非法操作！系统做了如下记录:<br>"  
Response.Write "操作IP："&Request.ServerVariables("REMOTE\_ADDR")&"<br>"  
Response.Write "操作时间："&Now&"<br>"  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"  
Response.Write "提交方式：GET<br>"  
Response.Write "提交参数："&Str\_Get&"<br>"  
Response.Write "提交数据："&Request.QueryString(Str\_Get)  
Response.End  
End If  
Next  
Next  
End If  
%>  
第3中方法需要你自己建个数据库表