[p]1、sql安全检测函数 [br]function checkstr(str,strtype) [br]dim strtmp [br]strtmp = "" [br]if strtype ="s" then [br]strtmp = replace(trim(str),"'","''") [br]strtmp = replace(strtmp,";","") [br]elseif strtype="i" then [br]if isnumeric(str)=false then str=false [br]strtmp = str [br]else [br]strtmp = str [br]end if [br]checkstr= strtmp [br]end function[/p]
[p]把这函数放在你页面代码里，你的接收参数可以这样写 [br]<% [br]yxzy=checkstr(request("yxzy"),"s") [br]%>[/p]
[p]上面是指字符串型，如果你的参数是数字型，比方id [br]<% [br]id=request("id") [br]%> [br]那么安全的，你可以这么写： [br]yxzy=checkstr(request("yxzy"),"i")[/p]
[p]2、过滤用户名中的非法字符 [br]function dealusername(username_) [br]dim regexpobj [br]dim i,n [br]dim username,tempstr,resultstr[/p]
[p]username=trim(username_) [br]set regexpobj=new regexp [br]regexpobj.global = true [br]regexpobj.pattern="^[a-za-z0-9_]+$" '只允许字母、数字和下划线 [br]'regexpobj.pattern="^\w+$" '效果同上[/p]
[p]resultstr=username [br]n=len(username) [br]for i=1 to n [br]tempstr=mid(username,i,1) [br]if not regexpobj.test(tempstr) then resultstr=replace(resultstr,tempstr,"") [br]next[/p]
[p]set regexpobj=nothing [br]dealusername=resultstr [br]end function[/p]
[p]3、防注入的安全request函数[br]function saferequest(paraname,paratype) [br]'--- 传入参数 --- [br]'paraname:参数名称-字符型 [br]'paratype:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符)[/p]
[p]dim paravalue [br]paravalue=request(paraname) [br]if paratype=1 then [br]if not isnumeric(paravalue) then [br]response.write "参数" & paraname & "必须为数字型！" [br]response.end [br]end if [br]else [br]paravalue=replace(paravalue,"'","''") [br]end if [br]saferequest=paravalue [br]end function[/p]
[p]4、外部连接进入网站[br]<% dim refurl [br]refurl = request.servervariables("http_referer") [br]if refurl <> "" and instr(refurl,request.servervariables("server_name")) = 0 then [br]response.write("进入网站首页") [br]response.end() [br]end if %> [br]防止从外部连接进入网站，也可以防止被iframe[/p]
[p]5、iis设置[br]sql注入入侵是根据iis给出的asp错误提示信息来入侵的，如果你把iis设置成不管出什么样的asp错误，只给出一种错误提示信息，即http 500错误，那么人家就没办法入侵了。具体设置请参看图2。主要把500:100这个错误的默认提示页面 c:\windows\help\iishelp\common\500-100.asp改成 [br]c:\windows\help\iishelp\common\500.htm即可，这时，无论asp运行中出什么错，服务器都只提示http 500错误。[/p]
[p]6、筛选掉不必要的sql语句[br]<% [br]'使用说明:在数据库连接页(如:conn.asp)或你要防注入的页头内包含此文件即可。<[url=mailto:!--@include]!--@include[/url] file="cf_sql.asp"-->(将@改为#)[/p]
[p][br]dim cfsql_i,cfsql_sqlchr,cfsql_chrcontent [br]cfsql_sqlchr = "select*|and'|or'|insertinto|deletefrom|altertable|update|createtable|createview|dropview|createindex|dropindex|createprocedure|dropprocedure|createtrigger|droptrigger|createschema|dropschema|createdomain|alterdomain|dropdomain|);|select@|declare@|print@|char(|select" [br]cfsql_sqlchrs = split(cfsql_sqlchr,"|")[/p]
[p][br]'====================================================== [br]'post方式处理 [br]'====================================================== [br]if request.form<>"" then [br]for each cfsql_chrcontent in request.form [br]for cfsql_i=0 to ubound(cfsql_sqlchrs) [br]select case cfsql_sqlchrs(cfsql_i) [br]case "select"'为避免select的多表关联查询 [br]if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"select")>0 and instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"from")>0 then [br]call cfsql_prompttitle() [br]end if [br]case "update"'update作额外处理,因update..set.. [br]if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"update")>0 and instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"set")>0 then [br]call cfsql_prompttitle() [br]end if [br]case else [br]if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),cfsql_sqlchrs(cfsql_i))>0 then [br]call cfsql_prompttitle() [br]end if [br]end select [br]next [br]next [br]end if[/p]
[p][br]'====================================================== [br]'get方式处理 [br]'====================================================== [br]if request.querystring<>"" then [br]for each cfsql_chrcontent in request.querystring [br]for cfsql_i=0 to ubound(cfsql_sqlchrs) [br]select case cfsql_sqlchrs(cfsql_i) [br]case "select"'为避免select的多表关联查询 [br]if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"select")>0 and instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"from")>0 then [br]call cfsql_prompttitle() [br]end if [br]case "update"'update作额外处理,因update..set.. [br]if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"update")>0 and instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"set")>0 then [br]call cfsql_prompttitle() [br]end if [br]case else [br]if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),cfsql_sqlchrs(cfsql_i))>0 then [br]call cfsql_prompttitle() [br]end if [br]end select [br]next [br]next [br]end if[/p]
[p]%>[/p]