ASP防止SQL注入方法

2015-08-12 16:00:53来源:作者:人点击

   通用防SQL注入代码ASP版

  代码

  dim sql_injdata

  SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"

  SQL_inj = split(SQL_Injdata,"|")

  If Request.QueryString<>"" Then

  For Each SQL_Get In Request.QueryString

  For SQL_Data=0 To Ubound(SQL_inj)

  if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then

  'Response.Write(Request.QueryString)

  Response.Write ""

  Response.end

  end if

  next

  Next

  End If

  If Request.Form<>"" Then 'liehuo.net

  For Each Sql_Post In Request.Form

  For SQL_Data=0 To Ubound(SQL_inj)

  if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then

  'Response.Write(Request.Form)

  Response.Write ""

  Response.end

  end if

  next

  Next

  End If

  sss=LCase(request.servervariables("QUERY_STRING"))

  if instr(sss,"select")<>0 or instr(sss,"inster")<>0 or instr(sss,"delete")<>0 or instr(sss,"(")<>0 or instr(sss,"'or")<>0 then

  response.write "

  你的网址不合法"

  response.end

  end if

  StrTemp=request.servervariables("server_name")&request.servervariables("url")&"?"&Request.QueryString

  StrTemp = LCase(StrTemp)

  If Instr(StrTemp,"select%20") or Instr(StrTemp,"insert%20") or Instr(StrTemp,"delete%20from") or Instr(StrTemp,"count(") or Instr(StrTemp,"drop%20table") or Instr(StrTemp,"update%20") or Instr(StrTemp,"truncate%20") or Instr(StrTemp,"asc(") or Instr(StrTemp,"mid(") or Instr(StrTemp,"char(") or Instr(StrTemp,"xp_cmdshell") or Instr(StrTemp,"exec%20master") or Instr(StrTemp,"net%20localgroup%20administrators") or Instr(StrTemp,"net%20user") or Instr(StrTemp,"%20or%20") or Instr(StrTemp,"'") or Instr(StrTemp,"%20") or Instr(StrTemp,"""") or Instr(StrTemp,"“") or Instr(StrTemp,"”") or Instr(StrTemp,":") or Instr(StrTemp,":") or Instr(StrTemp,";") or Instr(StrTemp,";") or Instr(StrTemp,",") or Instr(StrTemp,",") or Instr(StrTemp,"%27") then

  Response.Write ""

  Response.end

  End If

最新文章

123

最新摄影

微信扫一扫

第七城市微信公众平台