ASP anti-injection solution--enhanced version

Anti-injection | To solve <%

' ASP anti-injection solution
' Special page handling
' Because some pages pass through streaming (such as a form with file uploads)
' If you use a single, exhaustive form object, an error occurs
' So filter out these pages and use SQL ("detected strings") on the page.
' Garbage pig zero@new57.com
' Http://blog.csdn.net/cfaq



' Place this page in the header with the include method so that all pages can be invoked, such as include in conn.asp
' If you have a streaming upload page, add it to the table page to prevent form conflicts


Dim N_no,n_noarray,req_qs,req_f,n_i,n_dbstr,conn,n_rs,n_userip,n_thispage
N_userip = Request.ServerVariables ("REMOTE_ADDR")
N_thispage = LCase (Request.ServerVariables ("URL"))

N_no = "' |;| and|exec|insert|select|delete|update|count|*|%| Chr|mid|master|truncate|char|declare "' can modify its own string of suspected injection operations
N_noarray = Split (LCase (N_no), "|")


Call Dbopen ()
Call N_check_qs ()
Call N_checkpage ()
Call Dbclose ()


' Detects whether the current page is a special page is called N_check_form ()
Sub N_checkpage ()

Set n_rs = Server. CreateObject ("ADODB.") RecordSet ")
N_rs.open "SELECT * from page where spcpage like '% ' &N_thispage& '% '", conn,1,1
if (N_rs.eof and n_rs. BOF) Then
Call N_check_form ()
End If
N_rs. Close ()
Set n_rs = Nothing

End Sub



' detects a given string
Sub N_sql (Agsql)
' Here is not to record the database, if you want to change yourself please
N_check "CUS", Req_qs, "other"
End Sub

' Detect Request.Form
Sub N_check_form ()
If request.form<> "" Then
For each req_f in Request.Form
N_check Req_f,request.form (Req_f), "POST"
Next
End If
End Sub

' Detect Request.QueryString
Sub N_check_qs ()
If request.querystring<> "" Then
For each Req_qs in Request.QueryString
N_check req_qs,request.querystring (REQ_QS), "get"
Next
End If
End Sub

' Detection
Sub N_check (Ag,agsql,sqltype)
For n_i=0 to Ubound (N_noarray)
If Instr (LCase (Agsql), N_noarray (n_i)) <>0 Then
Call N_regsql (Ag,agsql,sqltype)
Response.Write "MO"
End If
Next
End Sub

' Record and stop output
' AG name
' Agsql content
' SqlType type
Sub N_regsql (Ag,agsql,sqltype)
if (sqltype<> "other") then
Conn.execute (INSERT into Sqlin (SQLIN_IP,SQLIN_WEB,SQLIN_FS,SQLIN_CS,SQLIN_SJ) VALUES (' &N_userip& "', '" &N_thispage& "', ' &sqltype&" ', ' "&ag&" ', ' "&agsql&" ') "
End If
Response.Write "<script Language=javascript>alert (' Please do not include illegal characters in the parameter attempt to inject!") ');</script> "
Response.Write "<span style= ' font-size:12px ' > Illegal operation! The system does the following record ↓<br> "
Response.Write "Operation IP:" &N_userip& "<br>"
Response.Write "Operation time:" &Now& "<br>"
Response.Write "Action page:" &N_thispage& "<br>"
Response.Write "Submission Method:" &sqltype& "<br>"
Response.Write "Submit Parameters:" &ag& "<br>"
Response.Write "Submit data:" &agsql& "</span>"

Response.End
End Sub


Sub dbopen ()
N_dbstr= "dbq=" +server.mappath ("Sql.mdb") + ";D efaultdir=;D river={microsoft Access DRIVER (*.mdb)};"
Set conn=server.createobject ("ADODB. CONNECTION ")
Conn.Open N_dbstr
End SUB


Sub dbclose ()
Conn.close
Set Conn = Nothing
End Sub
%>