如何防sql注入:网站WebSite如何防SQL注入来源: 发布时间:星期三, 2009年9月2日 浏览:3次 评论:0
第种:
squery=l(Request.ServerVariables("QUERY_STRING")) sURL=l(Request.ServerVariables("HTTP_HOST")) SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" SQL_inj = split(SQL_Injdata,"|") For SQL_Data=0 To Ubound(SQL_inj) instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then Response.Write "SQL通用防注入系统" Response.end end next 第 2种: SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" SQL_inj = split(SQL_Injdata,"|") If Request.QueryString<>"" Then For Each SQL_Get In Request.QueryString For SQL_Data=0 To Ubound(SQL_inj) instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then Response.Write "SQL通用防注入系统" Response.end end next Next End If If Request.Form<>"" Then For Each Sql_Post In Request.Form For SQL_Data=0 To Ubound(SQL_inj) instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then Response.Write "SQL通用防注入系统" Response.end end next next end 第 3种 <% '--------定义部份------------------ Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr '自定义需要过滤字串,用 "■"分离 Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" '---------------------------------- %> <% Str_Inf = split(Str_In,"■") '--------POST部份------------------ If Request.Form<>"" Then For Each Str_Post In Request.Form For Str_Xh=0 To Ubound(Str_Inf) If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then '--------写入数据库----------头----- Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" Set Str_db=Server.CreateObject("ADODB.CONNECTION") Str_db.open Str_dbstr Str_db.Execute("insert o SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") Str_db.close Set Str_db = Nothing '--------写入数据库----------尾----- Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法尝试注入!');</Script>" Response.Write "非法操作!系统做了如下记录:<br>" Response.Write "操作IP:"&Request.ServerVariables("REMOTE_ADDR")&"<br>" Response.Write "操作时间:"&Now&"<br>" Response.Write "操作页面:"&Request.ServerVariables("URL")&"<br>" Response.Write "提交方式:POST<br>" Response.Write "提交参 0
相关文章读者评论发表评论 |