ASP最新SQL防注入过滤涵数

sql|防注入

Function Checkstr(Str)
If Isnull(Str) Then
CheckStr = ""
Exit Function
End If
Str = Replace(Str,Chr(0),"", 1, -1, 1)
Str = Replace(Str, """", """, 1, -1, 1)
Str = Replace(Str,"<","<", 1, -1, 1)
Str = Replace(Str,">",">", 1, -1, 1)
Str = Replace(Str, "script", "script", 1, -1, 0)
Str = Replace(Str, "SCRIPT", "SCRIPT", 1, -1, 0)
Str = Replace(Str, "Script", "Script", 1, -1, 0)
Str = Replace(Str, "script", "Script", 1, -1, 1)
Str = Replace(Str, "object", "object", 1, -1, 0)
Str = Replace(Str, "OBJECT", "OBJECT", 1, -1, 0)
Str = Replace(Str, "Object", "Object", 1, -1, 0)
Str = Replace(Str, "object", "Object", 1, -1, 1)
Str = Replace(Str, "applet", "applet", 1, -1, 0)
Str = Replace(Str, "APPLET", "APPLET", 1, -1, 0)
Str = Replace(Str, "Applet", "Applet", 1, -1, 0)
Str = Replace(Str, "applet", "Applet", 1, -1, 1)
Str = Replace(Str, "[", "[")
Str = Replace(Str, "]", "]")
Str = Replace(Str, """", "", 1, -1, 1)
Str = Replace(Str, "=", "=", 1, -1, 1)
Str = Replace(Str, "'", "''", 1, -1, 1)
Str = Replace(Str, "select", "select", 1, -1, 1)
Str = Replace(Str, "execute", "execute", 1, -1, 1)
Str = Replace(Str, "exec", "exec", 1, -1, 1)
Str = Replace(Str, "join", "join", 1, -1, 1)
Str = Replace(Str, "union", "union", 1, -1, 1)
Str = Replace(Str, "where", "where", 1, -1, 1)
Str = Replace(Str, "insert", "insert", 1, -1, 1)
Str = Replace(Str, "delete", "delete", 1, -1, 1)
Str = Replace(Str, "update", "update", 1, -1, 1)
Str = Replace(Str, "like", "like", 1, -1, 1)
Str = Replace(Str, "drop", "drop", 1, -1, 1)
Str = Replace(Str, "create", "create", 1, -1, 1)
Str = Replace(Str, "rename", "rename", 1, -1, 1)
Str = Replace(Str, "count", "count", 1, -1, 1)
Str = Replace(Str, "chr", "chr", 1, -1, 1)
Str = Replace(Str, "mid", "mid", 1, -1, 1)
Str = Replace(Str, "truncate", "truncate", 1, -1, 1)
Str = Replace(Str, "nchar", "nchar", 1, -1, 1)
Str = Replace(Str, "char", "char", 1, -1, 1)
Str = Replace(Str, "alter", "alter", 1, -1, 1)
Str = Replace(Str, "cast", "cast", 1, -1, 1)
Str = Replace(Str, "exists", "exists", 1, -1, 1)
Str = Replace(Str,Chr(13),"<br>", 1, -1, 1)
CheckStr = Replace(Str,"'","''", 1, -1, 1)
End Function

时间： 2024-09-17 04:21:59

ASP最新SQL防注入过滤涵数的相关文章

asp 完美sql防注入实例程序

Dim Query_Badword,Form_Badword,i,Err_Message,Err_Web,name '------定义部份  头---------------------------------------------------------------------- Err_Message = 1  '处理方式:1=提示信息,2=转向页面,3=先提示再转向 Err_Web = "Err.Asp" '出错时转向的页面 Query_Badword="'∥and∥

asp.net sql防注入代码

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="TestSQLInjection.aspx.cs" Inherits="SQLInjection_TestSQLInjection" %> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h

常用sql防注入过滤函数

<% 'option explicit dim sql_injdata,sql_inj,sql_get,sql_data,sql_post dim strtemp SQL_injdata = "'|;|and|exec|insert|select|delete|update|count|*|%20from|chr|mid|master|truncate|char|declare" SQL_inj = split(SQL_Injdata,"|") If Requ

asp get post sql防注入函数

asp get post sql防注入函数 '----实现get请求的注入的拦截----- dim sql_injdata,Sql_Inj,SQL_Get,Sql_Post,Sql_DATA SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" SQL_inj = split(SQL_Injdata,"|") If R

php 过滤特殊字符及sql防注入代码

php 过滤特殊字符及sql防注入代码 <?php //方法一 //过滤',",sql语名 addslashes(); //方法二,去除所有html标签 strip_tags(); //方法三过滤可能产生代码 function php_sava($str) {     $farr = array(         "/s+/",                                                                        

php简单实现sql防注入的方法_php技巧

本文实例讲述了php简单实现sql防注入的方法.分享给大家供大家参考,具体如下: 这里没有太多的过滤,主要是针对php和mysql的组合. 一般性的防注入,只要使用php的 addslashes 函数就可以了. 以下是一段copy来的代码: PHP代码: $_POST = sql_injection($_POST); $_GET = sql_injection($_GET); function sql_injection($content) { if (!get_magic_quotes_gpc

mysql sql防注入简介与防注入实例

下面我们根据我编程序的经验来写一篇关于mysql教程 sql防注入简介与防注入实例吧. sql防注入简介: sql查询是一种用来数据与用户进行交互的文本语言,sql利用外部接将用户提交的数据发送给mysql数据库教程服务器进行处理,如果没有严密的过滤,可能导致数据丢失,如被删除,修改,而这样问题是网络管理员很难做事的,他们不能通过打系统被丁,或安装防火强可以控制了,. 下面我们来看一个简单的用户登陆实例. 一,创建用户表user create table user ( userid(int) n

php中addslashes函数与sql防注入_php技巧

本文实例讲述了php中addslashes函数与sql防注入.分享给大家供大家参考.具体分析如下: addslashes可会自动给单引号,双引号增加\\\\\\,这样我们就可以安全的把数据存入数据库中而不黑客利用,参数'a..z'界定所有大小写字母均被转义,代码如下: 复制代码 代码如下: echo addcslashes('foo[ ]','a..z'); //输出:foo[ ] $str="is your name o'reilly?"; //定义字符串,其中包括需要转义的字符 e

asp.net最强sql防注入代码

SqlConnection conn = new SqlCheck().oconn();       // 第2种调用的方法  SqlCheck.JK1986_CheckSql();         string osql = "select count(*) from admin";         SqlCommand ocmd = new SqlCommand(osql, conn); using System; using System.Data; using System.C