ASP Web page Anti-SQL injection code

Recently, the author of the station suffered to SQL intrusion, so the Internet search some related methods to prevent SQL injection.

A lot of versions, some people think that this section is good, some people think that the paragraph just, so the comprehensive collation, including the following:

The following are the referenced contents: <% Dim Fy_url,fy_a,fy_x,fy_cs (), FY_CL,FY_TS,FY_ZX '---define partial head------ FY_CL = 1 ' processing mode: 1 = hint information, 2 = Turn page, 3 = prompt before turning FY_ZX = "index." Asp "' Turn to page when error '---define partial tail------ On Error Resume Next Fy_url=request.servervariables ("Query_string") Fy_a=split (Fy_url, "&") ReDim Fy_cs (UBound (fy_a)) On Error Resume Next For fy_x=0 to UBound (fy_a) Fy_cs (fy_x) = Left (Fy_a (fy_x), InStr (Fy_a (fy_x), "=")-1) Next For fy_x=0 to UBound (Fy_cs) If Fy_cs (fy_x) <> "" Then If Instr (LCase (Fy_cs (fy_x)), "'" <>0 or Instr (LCase (Fy_cs)), "select" Fy_x or <>0 (LCase (Fy_cs (fy_x)), "Update") <>0 or Instr (LCase (Fy_cs)), "fy_x") Chr or <>0 ( LCase (Fy_cs (fy_x)), "Delete%20from") <>0 or Instr (LCase (Fy_cs)), ";" <>0 or Instr (LCase (Request (Fy_cs (fy_x)), insert) <>0 or INSTR (LCase (Request (Fy_cs)), "Mid" < >0 Or Instr (LCase (Request (Fy_cs (fy_x))), "Master." <>0 Then Select Case FY_CL Case "1" Response.Write "<script Language=javascript>alert" ("There is an error!") The value of the parameter "&fy_cs (fy_x) &" contains an illegal string! \ n \ nplease do not appear in the parameters: AND,SELECT,UPDATE,INSERT,DELETE,CHR and other illegal characters! \ n \ nplease i have set up not to SQL injection, please do not illegal means to me! '); Window.close ();</script> " Case "2" Response.Write "<script language=javascript>location.href= '" &Fy_Zx& "' </Script>" Case "3" Response.Write "<script Language=javascript>alert" ("There is an error!") The value of the parameter "&fy_cs (fy_x) &" contains an illegal string! \ n \ nplease do not appear in the parameters:, AND,SELECT,UPDATE,INSERT,DELETE,CHR and other illegal characters! \ n \ nyou designed the door, illegal intrusion please leave, thank you! Location.href= ' "&Fy_Zx&" ';</script> " End Select Response.End End If End If Next %>

The above code for more users, from the use of the speech, the effect is significant.

The following are the referenced contents: Dim Query_badword,form_badword,err_message,err_web,form_name '------Define partial head---------------------------------------------------------------------- Err_message = 1 ' processing mode: 1 = hint information, 2 = Turn page, 3 = prompt before turning Err_web = "err.asp" The page to turn when error Query_badword= "' ‖AND‖SELECT‖UPDATE‖CHR‖DELETE‖%20FROM‖;‖INSERT‖MID‖MASTER.‖SET‖CHR (37) ‖=" ' To define get illegal parameters in this section, use the ' ‖ ' number interval form_badword= "' ‖%‖&‖*‖#‖@‖=‖select‖and‖set‖delete" defines post illegal parameters in this section, using the "‖" number interval '------Define partial tail----------------------------------------------------------------------- ' On Error Resume Next '-----Filter the Get query value. If request. Querystring<> "" Then Chk_badword=split (Query_badword, "‖") For each query_form_name in Request.QueryString For i=0 to UBound (Chk_badword) If Instr (LCase, request. QueryString (Query_form_name)), Chk_badword (i)) <>0 Then Select Case Err_message Case "1" Response.Write "<script Language=javascript>alert" (' Pass parameter Error! The value of the parameter ' &form_name& ' contains an illegal string! \ n \ nplease do not appear in Parameters: and update delete; Insert the illegal characters such as Mid master! '); Window.close ();</script> " Case "2" Response.Write "<script language=javascript>location.href= '" &Err_Web& "' </Script>" Case "3" Response.Write "<script Language=javascript>alert" (' Pass parameter Error! The value of the parameter ' &form_name& ' contains an illegal string! \ n \ nplease do not appear in Parameters: and update delete; Insert the illegal characters such as Mid master! Location.href= ' "&Err_Web&" ';</script> " End Select Response.End End If NEXT NEXT End If '-----Filter the Post form values. If request.form<> "" Then Chk_badword=split (Form_badword, "‖") For each form_name in Request.Form For i=0 to UBound (Chk_badword) If Instr (LCase (Request.Form (Form_name)), Chk_badword (i)) <>0 Then Select Case Err_message Case "1" Response.Write "<script language=javascript>alert (' Wrong! The value of the form ' &form_name& ' contains an illegal string! \ n \ nplease do not appear in the form:% & * # () and other illegal characters! '); Window.close ();</script> " Case "2" Response.Write "<script language=javascript>location.href= '" &Err_Web& "' </Script>" Case "3" Response.Write "<script language=javascript>alert (' Wrong! The value of the parameter ' &form_name& ' contains an illegal string! \ n \ nplease do not appear in the form:% & * # () and other illegal characters! Location.href= ' "&Err_Web&" ';</script> " End Select Response.End End If NEXT NEXT End If

The above is a different version.

The following are the referenced contents: <% Dim Getflag Rem (Submitted by way) Dim errorsql Rem (illegal character) Dim Requestkey Rem (submit data) Dim fori Rem (circular marker) Errorsql = "' ~;~and~ (~) ~exec~update~count~*~%~chr~mid~master~truncate~char~declare" Rem (use half angle "~" for each sensitive character or word) Errorsql = Split (Errorsql, "~") If Request.ServerVariables ("request_method") = "Get" Then Getflag=true Else Getflag=false End If If Getflag Then For each requestkey in Request.QueryString For fori=0 to Ubound (errorsql) If Instr (LCase (Request.QueryString (Requestkey)), Errorsql (fori)) <>0 Then Response.Write "<script>alert (" "Warning: \ n Please do not try anything" "); location.href=" index.asp "";</script> " Response.End End If Next Next Else For each requestkey in Request.Form For fori=0 to Ubound (errorsql) If Instr (LCase (Request.Form (Requestkey)), Errorsql (fori)) <>0 Then Response.Write "<script>alert (" "Warning: \ n Please do not try anything" "); location.href=" index.asp "";</script> " Response.End End If Next Next End If %>

Put the above code into the conn file, the function is more comprehensive ...

If you have relevant experience or good method of prevention, welcome message Exchange ^_^

In addition, can also refer to the network of more mature ASP's CMS used in the anti-injection program, no matter how, just want to those code intrusion boring people say: good to others is to fulfill their own. (Wolf4ever)