你的笑容是我的一切.

ASP防SQL注入

拦截get请求的注入


dim sql_injdata
SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
SQL_inj = split(SQL_Injdata,"|")
If Request.QueryString＜＞"" Then
　For Each SQL_Get In Request.QueryString
　　For SQL_Data=0 To Ubound(SQL_inj)
　　　if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))＞0 Then
　　　　Response.Write "＜Script Language=****＞alert('本网站提示↓nn请不要在参数中包含非法字符尝试注入！');history.back(-1)＜/Script＞"
　　　　Response.end
　　　end if
　　next
　Next
End If


拦截post请求的注入

If Request.Form＜＞"" Then
　For Each Sql_Post In Request.Form
　　For SQL_Data=0 To Ubound(SQL_inj)
　　　if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))＞0 Then
　　　　Response.Write "＜Script Language=****＞alert('本网站提示↓nn请不要在参数中包含非法字符尝试注入！nnHTTP://www.521movie.com ');history.back(-1)＜/Script＞"
　　　　Response.end
　　　end if
　　next
　next
end if


程序判断访问线路

<%
'-------------------------------------------------------------------------------------------------
Function GetUserIPInfo '根据当前用户使用线路信息
Set XMLHTTP = Server.CreateObject("MSXML2.XMLHTTP")
XMLHTTP.Open "Get","http://www.dns7.cn/ip/?ip="&GetUserIP(),false
XMLHTTP.Send
strResult= bytes2BSTR(XMLHTTP.ResponseBody)
GetUserIPInfo=strResult
End Function
'-------------------------------------------------------------------------------------------------
Function RemoteGetIPInfo(IP) '根据用户IP,得到使用线路信息
Set XMLHTTP = Server.CreateObject("MSXML2.XMLHTTP")
XMLHTTP.Open "Get","http://www.dns7.cn/ip/?ip="&IP,false
XMLHTTP.Send
strResult= bytes2BSTR(XMLHTTP.ResponseBody)
RemoteGetIPInfo=strResult
End Function
'-------------------------------------------------------------------------------------------------
Function GetUserIP() '得到用户IP地址
Dim userip,userip2
userip = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
userip2 = Request.ServerVariables("REMOTE_ADDR")
If userip = "" Then
GetUserIP=userip2
Else
GetUserIP=userip
End If
End Function
'-------------------------------------------------------------------------------------------------
Function bytes2BSTR(vIn) '内部函数调用
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End Function
'-------------------------------------------------------------------------------------------------

%>

<%
Response.write GetUserIP()
%>
<br>
<%
Response.write RemoteGetIPInfo(GetUserIP())
%>
<br>
<%
Response.write GetUserIPInfo
%>