谁有MSSQL数据库，防注入的代码？??

[chong6]

这世界太可笑了！！！

搜索的全部都不能用，来这里找人解决纺注入的问题，没人能给个好使的防注入代码？

[gingerkang]

确实可笑,不过不是这个世界

[sniper1534]

<%



'--------定义部份------------------
Dim Neeao_Application_Value
Dim Neeao_Post,Neeao_Get,Neeao_Inject,Neeao_Inject_Keyword,Neeao_Kill_IP,Neeao_Write_Data
Dim Neeao_Alert_Url,Neeao_Alert_Info,Neeao_Kill_Info,Neeao_Alert_Type
Dim Neeao_Sec_Forms,Neeao_Sec_Form_open,Neeao_Sec_Form
'Call PutApplicationValue()
If IsArray(Application("Neeao_config_info"))=False Then Call PutApplicationValue()
Neeao_Application_Value = Application("Neeao_config_info")
'获取配置信息
Neeao_Inject = Neeao_Application_Value(0)
Neeao_Kill_IP = Neeao_Application_Value(1)
Neeao_Write_Data = Neeao_Application_Value(2)
Neeao_Alert_Url = Neeao_Application_Value(3)
Neeao_Alert_Info = Neeao_Application_Value(4)
Neeao_Kill_Info = Neeao_Application_Value(5)
Neeao_Alert_Type = Neeao_Application_Value(6)
Neeao_Sec_Forms = Neeao_Application_Value(7)
Neeao_Sec_Form_open = Neeao_Application_Value(8)

'安全页面参数
Neeao_Sec_Form = split(Neeao_Sec_Forms,"|")
Neeao_Inject_Keyword = split(Neeao_Inject,"|")

If Neeao_Kill_IP=1 Then Stop_IP

If Request.Form<>"" Then StopInjection(Request.Form)

If Request.QueryString<>"" Then StopInjection(Request.QueryString)

If Request.Cookies<>"" Then StopInjection(Request.Cookies)


Function Stop_IP()
Dim Sqlin_IP,rsKill_IP,Kill_IPsql
Sqlin_IP=Request.ServerVariables("REMOTE_ADDR")
Kill_IPsql="select Sqlin_IP from SqlIn where Sqlin_IP='"&Sqlin_IP&"' and kill_ip=1"
Set rsKill_IP=conn.execute(Kill_IPsql)
If Not(rsKill_IP.eof or rsKill_IP.bof) Then
N_Alert(Neeao_Kill_Info)
Response.End
End If
rsKill_IP.close
End Function



'sql通用防注入主函数
Function StopInjection(values)
Dim Neeao_Get,Neeao_i
For Each Neeao_Get In values

If Neeao_Sec_Form_open = 1 Then
For Neeao_i=0 To UBound(Neeao_Sec_Form)
If Instr(LCase(SelfName),Neeao_Sec_Form(Neeao_i))> 0 Then
Exit Function
else
Call Select_BadChar(values,Neeao_Get)
End If
Next

Else
Call Select_BadChar(values,Neeao_Get)
End If
Next
End Function

Function Select_BadChar(values,Neeao_Get)
Dim Neeao_Xh
Dim Neeao_ip,Neeao_url,Neeao_sql
Neeao_ip=Request.ServerVariables("HTTP_X_FORWARDED_FOR")
if Neeao_ip="" then Neeao_ip = Request.ServerVariables("REMOTE_ADDR")
Neeao_url = Request.ServerVariables("URL")

For Neeao_Xh=0 To Ubound(Neeao_Inject_Keyword)
If Instr(LCase(values(Neeao_Get)),Neeao_Inject_Keyword(Neeao_Xh))<>0 Then
response.write Neeao_Inject_Keyword(Neeao_Xh)
If Neeao_Write_Data = 1 Then
Neeao_sql = "insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Neeao_ip&"','"&Neeao_url&"','"&intype(values)&"','"&Neeao_Get&"','"&N_Replace(values(Neeao_Get))&"')"
'response.write Neeao_sql
conn.Execute(Neeao_sql)



End If
N_Alert(Neeao_Alert_Info)
Response.End
End If
Next
End Function

'输出警告信息
Function N_Alert(Neeao_Alert_Info)
Dim str
'response.write "test"
str = "<"&"Script Language=JavaScript"&">"
Select Case Neeao_Alert_Type
Case 1
str = str & "window.opener=null; window.close();"
Case 2
str = str & "alert('"&Neeao_Alert_Info&"');window.opener=null; window.close();"
Case 3
str = str & "location.href='"&Neeao_Alert_Url&"';"
Case 4
str = str & "alert('"&Neeao_Alert_Info&"');location.href='"&Neeao_Alert_Url&"';"
end Select
str = str & "<"&"/Script"&">"
response.write str
End Function

'判断注入类型函数
Function intype(values)
Select Case values
Case Request.Form
intype = "Post"
Case Request.QueryString
intype = "Get"
Case Request.Cookies
intype = "Cookies"
end Select
End Function

'干掉xss脚本
Function N_Replace(N_urlString)
N_urlString = Replace(N_urlString,"'","''")
N_urlString = Replace(N_urlString, ">", ">")
N_urlString = Replace(N_urlString, "<", "<")
N_Replace = N_urlString
End Function

Sub PutApplicationValue()
dim infosql,rsinfo
set rsinfo=conn.execute("select N_In,Kill_IP,WriteSql,alert_url,alert_info,kill_info,N_type,Sec_Forms,Sec_Form_open from sqlin_config where id=1")
Redim ApplicationValue(9)
dim i
for i=0 to 8
ApplicationValue(i)=rsinfo(i)
next
set rsinfo=nothing
Application.Lock
set Application("Neeao_config_info")=nothing
Application("Neeao_config_info")=ApplicationValue
Application.unlock
end Sub

'获取本页文件名
Function SelfName()
SelfName = Mid(Request.ServerVariables("URL"),InstrRev(Request.ServerVariables("URL"),"/")+1)
End Function

%>

[街头小贩]

个人拙见：
防注入:
1.判断数据类型,可以访问1=1或写SQL语句的形式
2.过滤任务字符
3.仔细校验你的代码.辟免代码漏洞

给你个过滤参数的函数吧！

Function Checkstr(Str)
       If IsNull(Str) Then
                  CheckStr = ""
                  Exit Function 
       End If
       Str = Replace(Str,Chr(0),"", 1, -1, 1)
       Str = Replace(Str, """", """, 1, -1, 1)
       Str = Replace(Str, "script", "script", 1, -1, 0)
       Str = Replace(Str, "SCRIPT", "SCRIPT", 1, -1, 0)
       Str = Replace(Str, "Script", "Script", 1, -1, 0)
       Str = Replace(Str, "script", "Script", 1, -1, 1)
       Str = Replace(Str, "object", "object", 1, -1, 0)
       Str = Replace(Str, "OBJECT", "OBJECT", 1, -1, 0)
       Str = Replace(Str, "Object", "Object", 1, -1, 0)
       Str = Replace(Str, "object", "Object", 1, -1, 1)
       Str = Replace(Str, "applet", "applet", 1, -1, 0)
       Str = Replace(Str, "APPLET", "APPLET", 1, -1, 0)
       Str = Replace(Str, "Applet", "Applet", 1, -1, 0)
       Str = Replace(Str, "applet", "Applet", 1, -1, 1)
       Str = Replace(Str, "[", "[")
       Str = Replace(Str, "]", "]")
       Str = Replace(Str, """", "", 1, -1, 1)
       Str = Replace(Str, "=", "=", 1, -1, 1)
       Str = Replace(Str, "'", "''", 1, -1, 1)
       Str = Replace(Str, "select", "select", 1, -1, 1)
       Str = Replace(Str, "execute", "&#101xecute", 1, -1, 1)
       Str = Replace(Str, "exec", "&#101xec", 1, -1, 1)
       Str = Replace(Str, "join", "join", 1, -1, 1)
       Str = Replace(Str, "union", "union", 1, -1, 1)
       Str = Replace(Str, "where", "where", 1, -1, 1)
       Str = Replace(Str, "insert", "insert", 1, -1, 1)
       Str = Replace(Str, "delete", "delete", 1, -1, 1)
       Str = Replace(Str, "update", "update", 1, -1, 1)
       Str = Replace(Str, "like", "like", 1, -1, 1)
       Str = Replace(Str, "drop", "drop", 1, -1, 1)
       Str = Replace(Str, "create", "create", 1, -1, 1)
       Str = Replace(Str, "rename", "rename", 1, -1, 1)
       Str = Replace(Str, "count", "count", 1, -1, 1)
       Str = Replace(Str, "chr", "chr", 1, -1, 1)
       Str = Replace(Str, "mid", "mid", 1, -1, 1)
       Str = Replace(Str, "truncate", "truncate", 1, -1, 1)
       Str = Replace(Str, "nchar", "nchar", 1, -1, 1)
       Str = Replace(Str, "char", "char", 1, -1, 1)
       Str = Replace(Str, "alter", "alter", 1, -1, 1)
       Str = Replace(Str, "cast", "cast", 1, -1, 1)
       Str = Replace(Str, "exists", "exists", 1, -1, 1)
       CheckStr = Replace(Str,"'","''", 1, -1, 1)
End Function

[街头小贩]

防注入:
1.判断数据类型,防止1=1或写SQL语句的情况
2.过滤任何字符串
3.仔细校验你的代码.辟免代码漏洞

在MSDN有一个专题是讲WEB安全的有时间听一听:http://www.microsoft.com/china/msdn/events/webcasts/shared/webcast/Series/DigitalSecurity.aspx
讲的很好