自己写一个防止SQL注入函数

新客网 XKER.COM 2005-02-22 来源： 收藏本文

<%
function sqlcheck(Str,errtype)
if Instr(LCase(Str),"select ") > 0 or Instr(LCase(Str),"insert ") > 0 or Instr(LCase(Str),"delete ") > 0 or Instr(LCase(Str),"delete from ") > 0 or Instr(LCase(Str),"count(") > 0 or Instr(LCase(Str),"drop table") > 0 or Instr(LCase(Str),"update ") > 0 or Instr(LCase(Str),"truncate ") > 0 or Instr(LCase(Str),"asc(") > 0 or Instr(LCase(Str),"mid(") > 0 or Instr(LCase(Str),"char(") > 0 or Instr(LCase(Str),"xp_cmdshell") > 0 or Instr(LCase(Str),"exec master") > 0 or Instr(LCase(Str),"net localgroup administrators") > 0 or Instr(LCase(Str),"and ") > 0 or Instr(LCase(Str),"net user") > 0 or Instr(LCase(Str),"or ") > 0 then
Response.write("<script language=javascript>" & vbcrlf & "window.location.href ='ShowError.asp?errtype=" & errtype & "'" & vbcrlf & "</script>")
Response.End
end if
Str=Replace(Str,"_","") '过滤SQL注入_
Str=Replace(Str,"*","") '过滤SQL注入*
Str=Replace(Str," ","") '过滤SQL注入空格
Str=Replace(Str,chr(34),"") '过滤SQL注入"
Str=Replace(Str,chr(39),"") '过滤SQL注入'
Str=Replace(Str,chr(91),"") '过滤SQL注入[
Str=Replace(Str,chr(93),"") '过滤SQL注入]
Str=Replace(Str,chr(37),"") '过滤SQL注入%
Str=Replace(Str,chr(58),"") '过滤SQL注入:
Str=Replace(Str,chr(59),"") '过滤SQL注入;
Str=Replace(Str,chr(43),"") '过滤SQL注入+
Str=Replace(Str,"{","") '过滤SQL注入{
Str=Replace(Str,"}","") '过滤SQL注入}
sqlcheck=Str '返回经过上面字符替换后的Str
end function
%>

• ·ASP+ACCESS数据库中文乱码问题解决
• ·编程实例 字母+数字验证码程序
• ·ASP连接数据库错误解决办法新法
• ·初学:ASP内建对象Response
• ·ASP网站Server object error的解决办法
• ·ASP技巧：让Len,Left,Right函数识别中文
• ·把网页中的电话号码生成图片的ASP程序
• ·ASP如何实现IE地址栏参数的判断
• ·细化解析：ASP连接11种数据库语法集锦
• ·ASP实现网页打开任何类型文件都保存
• ·ASP代码直接增加、删除ACCESS表和字段
• ·ASP：判断访问是否来自搜索引擎的函数
• ·ASP技巧：禁用页面缓存的五种方法
• ·学习ASP关于与变量子类型相关的函数
• ·ASP开发中的(VBScript)类基础学习
• ·ASP访问Excel文件