防SQL注入程序

<%

'防SQL注入程序
                Dim SQL_Key1,SQL_Word,SQL_Get,SQL_Data,SQL_Post
                        SQL_Key1="'|;|and|(|)|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"  '你想屏蔽的关键词
                        SQL_Word=Split(SQL_Key1,"|")

                        If Request.QueryString<>"" Then
                                For Each SQL_Get In Request.QueryString
                                        For SQL_Data=0 To Ubound(SQL_Word)
                                                If Instr(LCase(Request.QueryString(SQL_Get)),SQL_Word(SQL_Data))>0 Then
                                                        Response.Write("<Script Language=Javascript>{location.href='index.htm';}</Script>")
                                                        Response.End()
                                                End If
                                        Next
                                Next
                        End If

                        If Request.Form<>"" Then
                                For Each SQL_Post In Request.Form
                                        For SQL_Data=0 To Ubound(SQL_Word)
                                                If Instr(LCase(Request.Form(SQL_Post)),SQL_Word(SQL_Data))>0 Then
                                                        Response.Write("<Script Language=Javascript>{location.href='index.asp;}</Script>")
                                                        Response.End()
                                                End If
                                        Next
                                Next
                        End If

%>

文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags:
相关日志: