Getting Started: A new way to prevent SQL injection attacks

This article mainly describes how to correctly prevent SQL injection attacks. Recently, due to modifying an ASP program (with SQL Injection Vulnerabilities), I found some preventive measures on the Internet, the enforceability is not very good, so I have improved some methods on the Internet to write this ASP function for your reference.

The following is a reference clip:

 
 

  
  
Function SafeRequest (ParaName)
  
  
Dim ParaValue
  
  
ParaValue = Request (ParaName)
  
  
If IsNumeric (ParaValue) = True then
  
  
SafeRequest = ParaValue
  
  
Exit Function
  
  
ElseIf Instr (LCase (ParaValue), "select")> 0 or Instr (LCase (ParaValue), "insert ")
> 0 or Instr (LCase (ParaValue), "delete from")> 0 or Instr (LCase (ParaValue), "count (")
> 0 or Instr (LCase (ParaValue), "drop table")> 0 or Instr (LCase (ParaValue), "update ")
> 0 or Instr (LCase (ParaValue), "truncate")> 0 or Instr (LCase (ParaValue), "asc (")> 0
Or Instr (LCase (ParaValue), "mid (")> 0 or Instr (LCase (ParaValue), "char (")> 0 or
Instr (LCase (ParaValue), "xp_cmdshell")> 0 or Instr (LCase (ParaValue), "exec master ")
> 0 or Instr (LCase (ParaValue), "net localgroup administrators")> 0 or Instr (LCase (ParaValue), "and ")
> 0 or Instr (LCase (ParaValue), "net user")> 0 or Instr (LCase (ParaValue), "or")> 0 then
  
  
Response. Write "<script language = 'javascript '>"
  
  
Response. Write "alert ('invalid request! ');"'
 
 

SQL Injection Attack prompt information found

Response. Write "location. href = 'HTTP: // dev.yesky.com/';" 'web site redirection from SQL injection attacks

 
 

  
  
Response.Write "<script>"   
  
  
Response.end   
  
  
else   
  
  
SafeRequest=ParaValue   
  
  
End If   
  
  
End function  
 
 

Use the SafeRequest letter

The above content is a new way to prevent SQL injection attacks.

In this regard.