nginx防止SQL注入规则

$request_uri
This variable is equal to the *original* request URI as received from the client including the args. It cannot be modified. Look at $uri for the post-rewrite/altered URI. Does not include host name. Example: "/foo/bar.php?arg=baz"
这个变量等于从客户端发送来的原生请求URI，包括参数。它不可以进行修改。$uri变量反映的是重写后/改变的URI。不包括主机名张小三资源网。例如："/foo/bar.php?arg=baz"

$uri
This variable is the current request URI, without any arguments (see $args for those). This variable will reflect any modifications done so far by internal redirects or the index module. Note this may be different from $request_uri, as $request_uri is what was originally sent by the browser before any such modifications. Does not include the protocol or host name. Example: /foo/bar.html
这个变量指当前的请求URI，不包括任何参数(见$args)。这个变量反映任何内部重定向或index模块所做的修改。注意，这和$request_uri不同，因$request_uri是浏览器发起的不做任何修改的原生URI。不包括协议及主机名。例如张小三资源："/foo/bar.html"

$document_uri
The same as $uri.
同$uri.

下面是收集的一些简单规则：

if ($query_string ~* ".*('|--|union|insert|drop|truncate|update|from|grant|exec|where|select|and|or|count|chr|mid|like|iframe|script|alert|webscan|dbappsecurity|style|confirm|innerhtml|innertext|class).*")
{ return 500; }
if ($uri ~* .*(viewsource.jsp)$) { return 404; }
if ($uri ~* .*(/~).*) { return 404; }

修补空字节解析漏洞

if ($query_string ~* ".*[;'<>].*") { return 444; }
if ($request_uri ~ " ") { return 444; }

禁止未允许的IP访问目录执行PHP。未开启pathinfo的情况下在location ~ [^/].php(/|$)前加如下

location ~ /(xxx)/.*.(php|php5)?$
{ allow 允许的IP; deny all; }

开启pathinfo的情况下：在location ~ [^/].php(/|$)前加如下

location ^~ /xxx/ { #default_type text/plain; #expires 30d; allow 允许的IP; deny all; }

内部：

if ($uri ~* (.*)(insert|select|delete|update|count|master|truncate|declare|exec|*|%|')(.*)$ ) { return 403; }    

外部： 

if ($request_uri ~* "(cost()|(concat()") { return 403; }
if ($request_uri ~* "[+|(%20)]union[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]and[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]select[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]or[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]delete[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]update[+|(%20)]") { return 403; }
if ($request_uri ~* "[+|(%20)]insert[+|(%20)]") { return 403; }

溢出过滤

if ($query_string ~ "(<|%3C).*script.*(>|%3E)") { return 403; }
if ($query_string ~ "GLOBALS(=|[|\%[0-9A-Z]{0,2})") { return 403; }
if ($query_string ~ "_REQUEST(=|[|\%[0-9A-Z]{0,2})") { return 403; }
if ($query_string ~ "proc/self/environ") { return 403; }
if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") { return 403; }
if ($query_string ~ "base64_(en|de)code(.*)") { return 403; }

文件注入禁止

if ($query_string ~ "[a-zA-Z0-9_]=http://") { return 403; }
if ($query_string ~ "[a-zA-Z0-9_]=(..//?)+") { return 403; }
if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") { return 403; }

一些头部的参考：

if ($http_user_agent ~ ApacheBench|WebBench|Jmeter|JoeDog|Havij|GetRight|TurnitinBot|GrabNet|masscan|mail2000|github|wget|curl) { return 444; }
if ($http_user_agent ~ "Go-Ahead-Got-It") { return 444; }
if ($http_user_agent ~ "GetWeb!") { return 444; }
if ($http_user_agent ~ "Go!Zilla") { return 444; }
if ($http_user_agent ~ "Download Demon") { return 444; }
if ($http_user_agent ~ "Indy Library") { return 444; }
if ($http_user_agent ~ "libwww-perl") { return 444; }
if ($http_user_agent ~ "Nmap Scripting Engine") { return 444; }
if ($http_user_agent ~ "Load Impact") { return 444; }
if ($http_user_agent ~ "~17ce.com") { return 444; }
if ($http_user_agent ~ "WebBench*") { return 444; }
if ($http_referer ~* 17ce.com) { return 444; }
if ($http_user_agent ~* qiyunce) { return 444; }
if ($http_user_agent ~* YunGuanCe) { return 403; }
if ($http_referer ~* WebBench*") { return 444; }
if ($http_user_agent ~ "BLEXBot") { return 403; }
if ($http_user_agent ~ "MJ12bot") { return 403; }
if ($http_user_agent ~ "semalt.com") { return 403; }
屏蔽webkaka
iptables -I INPUT -s 122.226.213.3 -j DROP
加或者不加引号的效果都是一样的，但是如果名称中有空格则必须加双引号
~*不区分大小写 ~区分大小写

参考：Block Exploits
www.361way.com/nginx-ant-injection/2558.html