Improved SQL anti-injection (enhanced suppression error)

Source: Internet
Author: User
Tags include insert servervariables
Anti-injection
<%

' ASP anti-injection solution
' Special page handling
' Because some pages pass through streaming (such as a form with file uploads)
' If you use a single, exhaustive form object, an error occurs
' So filter out these pages and use SQL ("detected strings") on the page.
' Garbage pig zero@new57.com
' Http://blog.csdn.net/cfaq

' Source Download Http://www.new57.com/softback/sql.rar





' Place this page in the header with the include method so that all pages can be invoked, such as include in conn.asp
' If you have a streaming upload page, add it to the table page to prevent form conflicts



Dim N_no,n_noarray,req_qs,req_f,n_i,n_dbstr,conn,n_rs,n_userip,n_thispage
N_userip = Request.ServerVariables ("REMOTE_ADDR")
N_thispage = LCase (Request.ServerVariables ("URL"))

N_no = "' |;| and|exec|insert|select|delete|update|count|*|%| Chr|mid|master|truncate|char|declare "' can modify its own string of suspected injection operations
N_noarray = Split (LCase (N_no), "|")


Call Dbopen ()
Call N_check_qs ()
Call N_checkpage ()
Call Dbclose ()


' Detects whether the current page is a special page is called N_check_form ()
Sub N_checkpage ()

Set n_rs = Server. CreateObject ("ADODB.") RecordSet ")
N_rs.open "SELECT * from page where spcpage like '% ' &N_thispage& '% '", conn,1,1
if (N_rs.eof and n_rs. BOF) Then
Call N_check_form ()
End If
N_rs. Close ()
Set n_rs = Nothing

End Sub





' detects a given string
Sub N_sql (Agsql)
' Here is not to record the database, if you want to change yourself please
N_check "CUS", Req_qs, "other"
End Sub

' Detect Request.Form
Sub N_check_form ()
If request.form<> "" Then
For each req_f in Request.Form
N_check Req_f,request.form (Req_f), "POST"
Next
End If
End Sub

' Detect Request.QueryString
Sub N_check_qs ()
If request.querystring<> "" Then
For each Req_qs in Request.QueryString
N_check req_qs,request.querystring (REQ_QS), "get"
Next
End If
End Sub

' Detection
Sub N_check (Ag,agsql,sqltype)
For n_i=0 to Ubound (N_noarray)
If Instr (LCase (Agsql), N_noarray (n_i)) <>0 Then
Call N_regsql (Ag,agsql,sqltype)
Response.Write "MO"
End If
Next
End Sub

' Record and stop output
' AG name
' Agsql content
' SqlType type
Sub N_regsql (Ag,agsql,sqltype)
if (sqltype<> "other") then
Conn.execute (INSERT into Sqlin (SQLIN_IP,SQLIN_WEB,SQLIN_FS,SQLIN_CS,SQLIN_SJ) VALUES (' &N_userip& "', '" &N_thispage& "', ' &sqltype&" ', ' "&ag&" ', ' "&agsql&" ') "
End If
Response.Write "<script Language=javascript>alert (' Please do not include illegal characters in the parameter attempt to inject!") ');</script> "
Response.Write "<span style= ' font-size:12px ' > Illegal operation! The system does the following record ↓<br> "
Response.Write "Operation IP:" &N_userip& "<br>"
Response.Write "Operation time:" &Now& "<br>"
Response.Write "Action page:" &N_thispage& "<br>"
Response.Write "Submission Method:" &sqltype& "<br>"
Response.Write "Submit Parameters:" &ag& "<br>"
Response.Write "Submit data:" &agsql& "</span>"

Response.End
End Sub


Sub dbopen ()
N_dbstr= "dbq=" +server.mappath ("Sql.mdb") + ";D efaultdir=;D river={microsoft Access DRIVER (*.mdb)};"
Set conn=server.createobject ("ADODB. CONNECTION ")
Conn.Open N_dbstr
End SUB


Sub dbclose ()
Conn.close
Set Conn = Nothing
End Sub
%>



Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.