Prevent GET and POST injection

Hi.baidu.com/cncxz

Generally, http requests are similar to get and post requests. If illegal characters in parameter information in all post or get requests are filtered out, SQL injection is prevented. First, define that the request cannot contain the following characters: | And | exec | insert | select | delete | update | count | * | % | chr | mid | master | truncate | char | declare Separate the characters with "|" and then judge Request. QueryString. The specific code is as follows: Invalid character filtering for get requests: Dim SQL _injdata SQL _injdata = "| and | exec | insert | select | delete | update | count | * | % | chr | mid | master | truncate | char | declare" SQL _inj = split (SQL _Injdata, "| ") If Request. QueryString <> "Then For Each SQL _Get In Request. QueryString For SQL _Data = 0 To Ubound (SQL _inj) If instr (Request. QueryString (SQL _Get), SQL _Inj (SQL _DATA)> 0 Then Response. Write "<Script Language = javascript> {alert (please do not include invalid characters in the parameter !); History. back (-1)} </Script>" Response. end End if Next Next End If Illegal character filtering for post requests: If Request. Form <> "" Then For Each SQL _Post In Request. Form For SQL _Data = 0 To Ubound (SQL _inj) If instr (Request. Form (SQL _Post), SQL _Inj (SQL _DATA)> 0 Then Response. Write "<Script Language = javascript> {alert (please do not include invalid characters in the parameter !); History. back (-1)} </Script>" Response. end End if Next Next End if Then, you can Include the two pieces of code in the database connection file.