asp conn.asp

<%

Db = "x.mdb"
dim conn

On Error Resume Next

Set conn = Server.CreateObject("ADODB.Connection") 

connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source="&Server.MapPath(db)

conn.Open connstr 

If Err Then 
Err.Clear 

Set conn = Nothing 
Response.Write "数据库连接文件出错，请联系管理员。"

 Response.End

End If

%>

 

 

<%
'数据库连接代码
Const IsSqlDataBase = 0            '定义数据库类别，1为SQL数据库，0为Access数据库
Dim Conn,Db,ConnStr
If IsSqlDataBase = 1 Then
    'sql数据库连接参数：数据库名、用户密码、用户名、连接名（本地用local，外地用IP）
    Dim SqlDatabaseName,SqlPassword,SqlUsername,SqlLocalName
    SqlDatabaseName = "(local)"
    SqlPassword = " "
    SqlUsername = " "
    SqlLocalName = "(local)"
    ConnStr = "Provider = Sqloledb; User ID = " & SqlUsername & "; Password = " & SqlPassword & "; Initial Catalog = " & SqlDatabaseName & "; Data Source = " & SqlLocalName & ";"
Else
    Db = "x.mdb"
    ConnStr = "Provider = Microsoft.Jet.OLEDB.4.0;Data Source = " & Server.MapPath(Db)
End If
On Error Resume Next
Set Conn = Server.CreateObject("ADODB.Connection")
Conn.open ConnStr
If Err Then
    err.Clear
    Set Conn = Nothing
    Response.Write "数据库连接出错，请检查连接字串。"
    Response.End
End If


'防SQL注入函数
'--------定义部份------------------ 
Dim Str_Post,Str_Get,StrIn_Post,StrIn_Get,StrIn_Postf,StrIn_Getf,Str_Xh,Str_db,Str_dbstr 
'自定义需要过滤的字串,用 "|"分离 
StrIn_Post = ";|>|<|char(|'|or|and|exec|insert|select|delete|update|count(|master.|xp_cmdshell|truncate|net user|declare|drop table|net localgroup administrators"
StrIn_Get  = ";|>|<|char(|'|or|and|exec|insert|select|delete|update|count(|master.|xp_cmdshell|truncate|net%20user|declare|drop%20table|net%20localgroup%20administrators"
StrIn_Postf = split(StrIn_Post,"|")
StrIn_Getf = split(StrIn_Get,"|")

'Function SqlinPost()    
    '--------POST部份------------------ 
    If Request.Form<>"" Then 
        For each Str_Post In Request.Form
            For Str_Xh=0 To Ubound(StrIn_Postf)
                If Instr(LCase(Request.Form(Str_Post)),StrIn_Postf(Str_Xh))<>0 Then 
                Conn.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ,SqlIn_Time) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"','"&Now()&"')")
            '--------写入数据库----------尾----- 
                    Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>"
                    Response.Write "非法操作！系统做了如下记录:<br>" 
                    Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 
                    Response.Write "操作时间："&Now&"<br>" 
                    Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 
                    Response.Write "提交方式：POST<br>" 
                    Response.Write "提交参数："&Str_Post&"<br>" 
                    Response.Write "提交数据："&Request.Form(Str_Post) 
                    Response.End 
                End If 
            Next 
        Next 
    End If 
    '---------------------------------- 
'End Function

'Function SqlinGet()
    '--------GET部份------------------- 
    If Request.QueryString<>"" Then 
        For Each Str_Get In Request.QueryString 
            For Str_Xh=0 To Ubound(StrIn_Getf) 
                If Instr(LCase(Request.QueryString(Str_Get)),StrIn_Getf(Str_Xh))<>0 Then 
                '--------写入数据库----------头----- 
                Conn.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ,SqlIn_Time) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"','"&Now()&"')")
                '--------写入数据库----------尾----- 
                    Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" 
                    Response.Write "非法操作！系统做了如下记录:<br>" 
                    Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 
                    Response.Write "操作时间："&Now&"<br>" 
                    Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 
                    Response.Write "提交方式：GET<br>" 
                    Response.Write "提交参数："&Str_Get&"<br>" 
                    Response.Write "提交数据："&Request.QueryString(Str_Get) 
                    Response.End 
                End If 
            Next 
        Next 
    End If
    '----------------------------------
'End Function


'屏蔽I P地址
Set Rs_LockIP=Conn.Execute("Select LockIP FROM [Other]")
If Rs_LockIP(0)<>"" Then
    filtrate=split(Rs_LockIP(0),"|")
    blnIPMatched = False
    strUserIPAddress = Request.ServerVariables("REMOTE_ADDR")
    For i = 0 to ubound(filtrate)
    
        strCheckIPAddress = filtrate(i)
        If Right(strCheckIPAddress, 1) = "*" Then
            strCheckIPAddress = Replace(strCheckIPAddress, "*", "", 1, -1, 1)
            strUserIPAddress = Mid(strUserIPAddress, 1, Len(strCheckIPAddress))
            If strCheckIPAddress = strUserIPAddress Then blnIPMatched = True    
        Else
            If strCheckIPAddress = strUserIPAddress Then blnIPMatched = True    
        End If
            
        If blnIPMatched = True Then 
            SysEmail=Conn.Execute("Select SysEmail From WebConfig")(0)
            Response.Write "<table cellspacing=0 cellpadding=0 border=0 width=""100%""><tr><td align=center height=25><br><br><br><br><br><br><br><br>您的IP地址 "&Request.ServerVariables("REMOTE_ADDR")&" 被本站屏蔽<br><br>请<a href=mailto:"& SysEmail &">联系管理员</a>解除对您的IP地址的屏蔽！</td></tr></table>"
            Rs_LockIP.Close
            Set Rs_LockIP=Nothing
            Response.End
        End if
    Next
End if
Rs_LockIP.Close
Set Rs_LockIP=Nothing
%>