加入Conn.asp文件中的语句，防SQL注入

Function FlasHack()
Dim flashack_Post,flashack_Get,flashack_In,flashack_Inf,flashack_Xh,flashack_db,flashack_dbstr
flashack_In = "'※;※and※exec※insert※select※delete※update※count※*※%※chr※mid※master※truncate※char※declare"
flashack_Inf = split(flashack_In,"※")
If Request.QueryString<>"" Then
   For Each flashack_Get In Request.QueryString
    For flashack_Xh=0 To Ubound(flashack_Inf)
     If Instr(LCase(Request.QueryString(flashack_Get)),flashack_Inf(flashack_Xh))<>0 Then
      Response.Write "<Script Language=JavaScript>alert('\n\n请不要在参数中包含非法字符尝试注入！');</Script>"
      str_temp="insert into FlashHack(IP,AddTime,WebPage,Paramter,Value) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&now()&"',"&Safestr(left(Request.ServerVariables("URL"),200))&","&Safestr(left(flashack_Get,50))&","&Safestr(left(Request.QueryString(flashack_Get),200))&")"
      'response.Write(str_stemp)
      Conn.Execute(str_stemp)
      str_temp=""
      Response.End
     End If
    Next
   Next
End If
End Function

文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags: 防SQL注入防SQL注入
相关日志: