被动防SQL注入

最新推荐文章于 2022-03-20 22:58:48 发布

xck01

最新推荐文章于 2022-03-20 22:58:48 发布

阅读量752

点赞数 1

分类专栏： ASP 文章标签： sql function url each insert delete

本文链接：https://blog.youkuaiyun.com/xck01/article/details/2451022

版权

ASP 专栏收录该内容

16 篇文章

订阅专栏

call sql_into_check() '调用ql防注入代码2008-05-14 kz

if pageName()="xxx.asp" or pageName()="xxx1.asp" or pageName()="xxx2.asp" then
'路过
else

If Request.Form<>"" Then
  For Each Sql_Post In Request.Form
   For SQL_Data=0 To Ubound(SQL_inj)
    if instr(lcase(Request.Form(Sql_Post)),Sql_Inj(Sql_DATA))>0 Then
     Response.Write "<Script Language=JavaScript>alert('SQL防注入提示：/n你提交了非法字符,此次提交失败!');history.back(-1);</Script>"
     Response.end
    end if
   next
  next
end if
end if

If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
  For SQL_Data=0 To Ubound(SQL_inj)
   if instr(lcase(Request.QueryString(SQL_Get)),Sql_Inj(Sql_DATA))>0 Then
    Response.Write "<Script Language=JavaScript>alert('SQL防注入提示：/n你提交了非法字符,此次提交失败!');history.back(-1);</Script>"
    Response.end
   end if
  next
Next
End If
end sub

'过滤涵数2008-05-15 by kz
Function CheckNumeric(Number)
If Not IsNumeric(Number) then
CheckNumeric = 0
Else
CheckNumeric = Number
End If
End Function

Function Checkstr(Str)
If Isnull(Str) Then
CheckStr = ""
Exit Function
End If
Str = Replace(Str,Chr(0),"")
CheckStr = Replace(Str,"'","''")
End Function

Public Function pageName()
Dim url,urlParts
url = Request.ServerVariables("SCRIPT_NAME")
urlParts = Split(url,"/")
pageName = urlParts(UBound(urlParts))
End Function