asp sql injection

[Reprinted] My asp code for preventing SQL InjectionAuthor: feng [Brave wind]Source: http://feng.cnblog.com.cn/Look.asp? Logid = 213Function SQL _zr (str)Dim w, jStr = lcase (str)W = "percent % Percent lt; * percent # percent @ percent (percent) percent = percent and percent select distinct update every chr hour delete percent % 20from percent; into insert into

Here we will introduce another way to prevent SQL injection attack in ASP, this method is not only applicable in ASP, in fact, in any language that uses ADO object model to interact with database, it may be more appropriate to say that the method of anti SQL

Recently took over someone else a project, found that there is a SQL injection vulnerability, because do not want to change too much code, so that parameter method of anti-injection I don't need it. Can only use the traditional stupid point of the way. 1, new Global.asax file. 2. Add the following code: void Application_BeginRequest (object sender, EventArgs e)

The function used to prevent SQL injection attacks can be used directly, but we will not use it, but we need to enhance our safety awareness. Copy Code code as follows: '========================== ' Filter the SQL in the submission form '========================== function Forsqlform () Dim fqys,errc,i,items Dim Nothis (18) Nothis (0) = "NET use

Recently, the author of the station suffered to SQL intrusion, so the Internet search some related methods to prevent SQL injection. A lot of versions, some people think that this section is good, some people think that the paragraph just, so the comprehensive collation, including the following: The following are the referenced contents:Dim Fy_url,fy_

'****************************** ' Function: Checkstr (byVal chkstr) ' Parameters: Chkstr, characters to be validated ' Author: Arisisi ' Date: 2007/7/15 ' Description: SQL injection of dangerous characters for heavy-coded processing ' Example: Checkstr ("and 1=1 or select * from") '****************************** Function checkstr (ByVal chkstr) Dim Str:str=chkstr Str=trim (STR) If IsNull (STR) Then Checkstr

Here are 4 functions that are enough to withstand all SQL injection vulnerabilities! Read the code and you can digest it. Be careful to filter all Request objects: including Request.cookie, request. ServerVariables and so on are easily overlooked objects: Copy Code code as follows: Function Killn (ByVal s1) ' filter numeric parameter if not IsNumeric (S1) then killn= 0 Else

"Response.Write " "Case "2"Response.Write ""Case "3"Response.Write " "End SelectResponse.EndEnd IfNEXTNEXTEnd If The above is a different version. Dim Getflag Rem (Submission method)Dim errorsql Rem (illegal character)Dim Requestkey Rem (submit data)Dim fori Rem (Loop Mark)Errorsql = "' ~;~and~ (~) ~exec~update~count~*~%~chr~mid~master~truncate~char~declare" Rem (use half-width "~" to open each sensitive character or word)Errorsql = Split (Errorsql, "~")If Request.ServerVariables ("request_metho

ASP SQL Super Anti-injection code Dim s_badstr, N, IS_badstr = "' n = Len (S_BADSTR)Safe = TrueFor i = 1 to nIf Instr (str, Mid (S_BADSTR, I, 1)) > 0 ThenSafe = FalseExit FunctionEnd IfNextEnd Function' The following code directly determines whether the URL in which the request occurred contains illegal charactersOn Error Resume NextDim strtemp If LCase (Reques

usingSystem;usingSystem.Collections.Generic;usingSystem.Linq;usingsystem.web;usingSystem.Web.UI;usingSystem.Web.UI.WebControls;usingSystem.Configuration; Public Partial class_default:system.web.ui.page{protected voidPage_Load (Objectsender, EventArgs e) { } protected voidBtnlogin_click (Objectsender, EventArgs e) { stringName =txtUsername.Text; stringpass =Txtpass.text; Dataclassesdatacontext lqdb=NewDataclassesdatacontext (); varresult = fromVinchLqdb.tbuserwhereV.username = = name

Case "1″ Response.Write "Alert (' argument error! The value of parameter ' name ' contains an illegal string! Please do not appear in the parameter: and update delete; Insert an illegal character such as Mid master! '); Window.close (); " Case "2″ Response.Write "location.href=" Err_Web "'" Case "3″ Response.Write "Alert (' argument error! The value of parameter ' name ' contains an illegal string! Please do not appear in the parameter: and update delete; Insert an illegal character such as Mid

, post, client-agent, Cookie, server enviroment...2. Why can an attacker inject the statement it wants "? Because server applications are pieced together (pay special attention to this term) with SQL statements, attackers may have the opportunity to include SQL keywords or operators in the submitted data, to construct the statements they want.3. What is the final result of

What is SQL injection? My understanding of SQL injection is that some people can input through malicious parameters, let the background to execute this SQL, and then to get data or destroy the purpose of the database!For a simple query example, background

Squery=lcase (Request.ServerVariables ("query_string"))Surl=lcase (Request.ServerVariables ("Http_host"))Sql_injdata = ": |;|>|Sql_inj = Split (Sql_injdata, "|")For Sql_data=0 to Ubound (Sql_inj)If InStr (Squerysurl,sql_inj (Sql_data)) >0 ThenResponse.Write "Your actions may be SQL injection behavior. "Response.EndEnd IfNext%> I think there is also a way to prevent SQL