ASP prevents SQL injection methods

Generic anti-SQL Injection code ASP edition

Code

Dim sql_injdata

Sql_injdata = "' |and|exec|insert|select|delete|update|count|*|%| Chr|mid|master|truncate|char|declare "

Sql_inj = Split (Sql_injdata, "|")

If request.querystring<> "" Then

For each sql_get in Request.QueryString

For Sql_data=0 to Ubound (Sql_inj)

If InStr (Request.QueryString (Sql_get), Sql_inj (sql_data)) >0 Then

' Response.Write (Request.QueryString)

Response.Write ""

Response.End

End If

Next

Next

End If

If request.form<> "" Then ' liehuo.net

For each sql_post in Request.Form

For Sql_data=0 to Ubound (Sql_inj)

If InStr (Request.Form (Sql_post), Sql_inj (sql_data)) >0 Then

' Response.Write (Request.Form)

Response.Write ""

Response.End

End If

Next

Next

End If

Sss=lcase (Request.ServerVariables ("query_string"))

If InStr (SSS, "select") <>0 or InStr (SSS, "Inster") <>0 or InStr (SSS, "delete") <>0 or InStr (SSS, "(") < >0 or InStr (SSS, "' or") <>0 then

Response.Write "

Your URL is illegal.

Response.End

End If

Strtemp=request.servervariables ("SERVER_NAME") &request.servervariables ("url") & "?" &request.querystring

strtemp = LCase (strtemp)

If Instr (strtemp, "select%20") or Instr (strtemp, "insert%20") or Instr (strtemp, "Delete%20from") or Instr (strtemp, "Count (") or Instr (strtemp," drop%20table ") or Instr (strtemp," update%20 ") or Instr (strtemp," truncate%20 ") or Instr (strtemp," ASC (") or Instr (strtemp, Mid () or INSTR (strtemp," char (") or Instr (strtemp," xp_cmdshell ") or Instr (strtemp," exec% ") 20master ") or Instr (strtemp," net%20localgroup%20administrators ") or Instr (strtemp," Net%20user ") or Instr (strtemp,"% 20or%20 ") or Instr (strtemp," ") or Instr (strtemp,"%20 ") or Instr (strtemp," "") or Instr (strtemp, "" ") or Instr (strtemp," "") ") or Instr (strtemp,": ") or Instr (strtemp,": ") or Instr (strtemp,"; ") or Instr (strtemp, ";") or Instr (strtemp, ",") or Instr (strtemp, ",") or Instr (strtemp, "%27") Then

Response.Write ""

Response.End

End If