SQL防注SQL防注入代码入代码

<%
'--------定义部份------------------
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr
'自定义需要过滤的字串,用 "■"分离
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare"
'----------------------------------
%>

<%
Str_Inf = split(Str_In,"■")
'--------POST部份------------------
If Request.Form<>"" Then
For Each Str_Post In Request.Form

For Str_Xh=0 To Ubound(Str_Inf)
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then
'--------写入数据库----------头-----

dim datapath
datapath=server.mappath("SqlIn.mdb")
set Str_db=server.CreateObject("adodb.connection")
Str_db.open"provider=microsoft.jet.oledb.4.0;data source="&datapath

Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')")
Str_db.close
Set Str_db = Nothing
'--------写入数据库----------尾-----
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>"
Response.Write "非法操作！系统做了如下记录:<br>"
Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：POST<br>"
Response.Write "提交参数："&Str_Post&"<br>"
Response.Write "提交数据："&Request.Form(Str_Post)
Response.End
End If
Next

Next
End If
'----------------------------------

'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Str_Get In Request.QueryString

For Str_Xh=0 To Ubound(Str_Inf)
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then
'--------写入数据库----------头-----
datapath=server.mappath("SqlIn.mdb")
set Str_db=server.CreateObject("adodb.connection")
Str_db.open"provider=microsoft.jet.oledb.4.0;data source="&datapath
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')")
Str_db.close
Set Str_db = Nothing
'--------写入数据库----------尾-----

Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>"
Response.Write "非法操作！系统做了如下记录:<br>"
Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：GET<br>"
Response.Write "提交参数："&Str_Get&"<br>"
Response.Write "提交数据："&Request.QueryString(Str_Get)
Response.End
End If
Next
Next
End If
%>

conn.asp
<%
DIM objconn,strConn,strDB,strSql
DIM strErr
'更改数据库名字
StrConn="Provider=SQLOLEDB.1;Password=goojob2006;Persist Security Info=True;User ID=goojob;Initial Catalog=eatdrink;Data Source=(local);Connect Timeout=15"
'如果服务器采用较老版本Access驱动，请用下面连接方法
'strConn="driver={Microsoft Access Driver (*.mdb)};dbq=" & Server.MapPath(strDB)
'strConn = "DRIVER={SQL SERVER};SERVER=127.0.0.1;UID=sa;PWD=;DATABASE=guestbook"

SET objconn = Server.CreateObject("ADODB.Connection")
objconn.Open StrConn
dim objrs
set objrs=server.CreateObject("ADODB.Recordset")
dim objrsm
set objrsm=server.CreateObject("ADODB.Recordset")
'数据库相关函数
FUNCTION CloseDatabase()
objconn.Close
SET objconn = NOTHING
END FUNCTION
%>
<!--#include file="fun1.asp"-->


数据库部分

SqlIn_ID 自动编号
SqlIn_IP 注入IP 文本
SqlIn_WEB 防注入页面 文本
SqlIn_TIME 注入时间 时间
SqlIn_FS 注入方式 文本
SqlIn_CS 文本
SqlIn_SJ 注入的非法代码 文本