zoukankan
html css js c++ java
ASP上两个防止SQL注入式攻击Function
'
'==========================
'
'过滤提交表单中的SQL
'
'==========================
function
ForSqlForm()
dim
fqys,errc,i,items
dim
nothis(
18
)
nothis(
0
)
=
"
net user
"
nothis(
1
)
=
"
xp_cmdshell
"
nothis(
2
)
=
"
/add
"
nothis(
3
)
=
"
exec%20master.dbo.xp_cmdshell
"
nothis(
4
)
=
"
net localgroup administrators
"
nothis(
5
)
=
"
select
"
nothis(
6
)
=
"
count
"
nothis(
7
)
=
"
asc
"
nothis(
8
)
=
"
char
"
nothis(
9
)
=
"
mid
"
nothis(
10
)
=
"
''
"
nothis(
11
)
=
"
:
"
nothis(
12
)
=
"
""
"
nothis(
13
)
=
"
insert
"
nothis(
14
)
=
"
delete
"
nothis(
15
)
=
"
drop
"
nothis(
16
)
=
"
truncate
"
nothis(
17
)
=
"
from
"
nothis(
18
)
=
"
%
"
'
'nothis(19)="@"
errc
=
false
for
i
=
0
to
ubound
(nothis)
for
each
items in request.Form
if
instr
(request.Form(items),nothis(i))
<>
0
then
response.write(
"
<div>
"
)
response.write(
"
你所填写的信息:
"
&
server.HTMLEncode(request.Form(items))
&
"
<br>含非法字符:
"
&
nothis(i))
response.write(
"
</div>
"
)
response.write(
"
对不起,你所填写的信息含非法字符!<a href=""#"" onclick=""history.back()"">返回</a>
"
)
response.End()
end
if
next
next
end function
'
'==========================
'
'过滤查询中的SQL
'
'==========================
function
ForSqlInjection()
dim
fqys,errc,i
dim
nothis(
19
)
fqys
=
request.ServerVariables(
"
QUERY_STRING
"
)
nothis(
0
)
=
"
net user
"
nothis(
1
)
=
"
xp_cmdshell
"
nothis(
2
)
=
"
/add
"
nothis(
3
)
=
"
exec%20master.dbo.xp_cmdshell
"
nothis(
4
)
=
"
net localgroup administrators
"
nothis(
5
)
=
"
select
"
nothis(
6
)
=
"
count
"
nothis(
7
)
=
"
asc
"
nothis(
8
)
=
"
char
"
nothis(
9
)
=
"
mid
"
nothis(
10
)
=
"
''
"
nothis(
11
)
=
"
:
"
nothis(
12
)
=
"
""
"
nothis(
13
)
=
"
insert
"
nothis(
14
)
=
"
delete
"
nothis(
15
)
=
"
drop
"
nothis(
16
)
=
"
truncate
"
nothis(
17
)
=
"
from
"
nothis(
18
)
=
"
%
"
nothis(
19
)
=
"
@
"
errc
=
false
for
i
=
0
to
ubound
(nothis)
if
instr
(FQYs,nothis(i))
<>
0
then
errc
=
true
end
if
next
if
errc
then
response.write
"
查询信息含非法字符!<a href=""#"" onclick=""history.back()"">返回</a>
"
response.end
end
if
end function
查看全文
相关阅读:
ACMICPC 2009 China Northeast Area Contest :(
2576 数论
sql source control and sql prompt
C语言中的单精度双精度数的有效位数
[软件调试学习笔记]防止栈缓冲区溢出的基于Cookie的安全检查机制
A tiny introduction to asynchronous IO
Mysql扩展之replication概述
C语言中的单精度双精度数的有效位数
MySQL Cluster(MySQL 集群) 初试
MySQL Cluster(MySQL 集群) 初试
原文地址:https://www.cnblogs.com/aowind/p/270995.html
最新文章
C#通过ODBC连接mysql
设计模式桥接模式(Bridge Pattern)
64位操作系统下IIS报“试图加载格式不正确的程序”错误 .
Form Effect 表单美化插件
机锋网《Windows Phone 7教程1.0 》超过500篇文章
vs 2008 添加 服务引用 与 web引用 差别与联系
反射.CS文件(动态加载.CS文件)(
jQuery的unbind()函数详解
LINQ学习
Asp.Net平台下的图片在线裁剪功能的实现
热门文章
第九章:XML文档集成安全
第九章:XML文档集成发送框架
第九章:XML文档集成本章总结
第九章:XML文档集成实体键类
第九章:XML文档集成定制已存在的XML文档
PHP cookie和session的分析(转)
博客回复正常了
preg_match_all结合str_replace替换内容中所有img
php正则与email
根据IP跳转到用户所在城市
Copyright © 2011-2022 走看看