ASP防SQL 注入漏洞检查函数

开新窗口(view plain)复制(copy to clipboard)打印(print)关于(about)
  1. ' ============================================   
  2. ' SQL 注入漏洞检查   
  3. '     每一页开头进行测试   
  4. ' ============================================   
  5. Function CHECK_SQLCODE(sqlValue)   
  6. Dim strTemp   
  7. If LCase(Request.ServerVariables("HTTPS")) = "off" Then  
  8. strTemp = "http://"  
  9. Else  
  10. strTemp = "https://"  
  11. End If  
  12. strTemp = strTemp & Request.ServerVariables("SERVER_NAME")   
  13. If Request.ServerVariables("SERVER_PORT") <> 80 Then  
  14. strTemp = strTemp & ":" & Request.ServerVariables("SERVER_PORT")   
  15. End If  
  16. strTemp = strTemp & Request.ServerVariables("URL")   
  17. If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & Trim(Request.QueryString)   
  18. strTemp = LCase(strTemp)   
  19. If Instr(strTemp, "select%20") _   
  20. Or Instr(strTemp,"insert%20") _   
  21. Or Instr(strTemp, "delete%20from") _   
  22. Or Instr(strTemp, "count(") _   
  23. Or Instr(strTemp, "drop%20table") _   
  24. Or Instr(strTemp, "update%20") _   
  25. Or Instr(strTemp, "truncate%20") _   
  26. Or Instr(strTemp, "asc(") _   
  27. Or Instr(strTemp, "mid(") _   
  28. Or Instr(strTemp, "char(") _   
  29. Or Instr(strTemp, "xp_cmdshell") _   
  30. Or Instr(strTemp, "exec%20master") _   
  31. Or Instr(strTemp, "net%20localgroup%20administrators") _   
  32. Or Instr(strTemp, "net%20user") _   
  33. Or Instr(strTemp, "'") _   
  34. Or Instr(strTemp, "%20or%20") Then  
  35. '非法地址   
  36. CHECK_SQLCODE = False  
  37. Else  
  38. CHECK_SQLCODE = True  
  39. End If  
  40. End Function  
posted @ 2008-07-11 08:43  广陵散仙（www.cnblogs.com/junzhongxu/）  阅读(380)  评论(0)    收藏  举报