程序師世界是廣大編程愛好者互助、分享、學習的平台,程序師世界有你更精彩!
首頁
編程語言
C語言|JAVA編程
Python編程
網頁編程
ASP編程|PHP編程
JSP編程
數據庫知識
MYSQL數據庫|SqlServer數據庫
Oracle數據庫|DB2數據庫
 程式師世界 >> 編程語言 >> 網頁編程 >> ASP編程 >> 關於ASP編程 >> ASP防止SQL注入方法

ASP防止SQL注入方法

編輯:關於ASP編程

       通用防SQL注入代碼ASP版

      代碼

      dim sql_injdata

      SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"

      SQL_inj = split(SQL_Injdata,"|")

      If Request.QueryString<>"" Then

      For Each SQL_Get In Request.QueryString

      For SQL_Data=0 To Ubound(SQL_inj)

      if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then

      'Response.Write(Request.QueryString)

      Response.Write ""

      Response.end

      end if

      next

      Next

      End If

      If Request.Form<>"" Then 'liehuo.net

      For Each Sql_Post In Request.Form

      For SQL_Data=0 To Ubound(SQL_inj)

      if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then

      'Response.Write(Request.Form)

      Response.Write ""

      Response.end

      end if

      next

      Next

      End If

      sss=LCase(request.servervariables("QUERY_STRING"))

      if instr(sss,"select")<>0 or instr(sss,"inster")<>0 or instr(sss,"delete")<>0 or instr(sss,"(")<>0 or instr(sss,"'or")<>0 then

      response.write "

      你的網址不合法"

      response.end

      end if

      StrTemp=request.servervariables("server_name")&request.servervariables("url")&"?"&Request.QueryString

      StrTemp = LCase(StrTemp)

      If Instr(StrTemp,"select%20") or Instr(StrTemp,"insert%20") or Instr(StrTemp,"delete%20from") or Instr(StrTemp,"count(") or Instr(StrTemp,"drop%20table") or Instr(StrTemp,"update%20") or Instr(StrTemp,"truncate%20") or Instr(StrTemp,"asc(") or Instr(StrTemp,"mid(") or Instr(StrTemp,"char(") or Instr(StrTemp,"xp_cmdshell") or Instr(StrTemp,"exec%20master") or Instr(StrTemp,"net%20localgroup%20administrators") or Instr(StrTemp,"net%20user") or Instr(StrTemp,"%20or%20") or Instr(StrTemp,"'") or Instr(StrTemp,"%20") or Instr(StrTemp,"""") or Instr(StrTemp,"“") or Instr(StrTemp,"”") or Instr(StrTemp,":") or Instr(StrTemp,":") or Instr(StrTemp,";") or Instr(StrTemp,";") or Instr(StrTemp,",") or Instr(StrTemp,",") or Instr(StrTemp,"%27") then

      Response.Write ""

      Response.end

      End If

    1. 上一頁:
    2. 下一頁:
    Copyright © 程式師世界 All Rights Reserved