SQL通用防注入模块

'===============================================================
Dim CSB_NoSqlHack_AllStr,CSB_NoSqlHack_Str,CSB_NoSqlHack_ComeUrlGet,CSB_NoSqlHack_ComeUrlPost,CSB_NoSqlHack_Get,CSB_NoSqlHack_Post,CSB_NoSqlHack_i
'On Error Resume Next
'定义SQL过滤字符集
CSB_NoSqlHack_AllStr="'|;|and|(|)|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
'QueryString 集合检索 HTTP 查询字符串中变量的值。HTTP 查询字符串由问号 (?) 后的值指定。
CSB_NoSqlHack_ComeUrlGet = Request.QueryString
'Request.Form 集合检索 Form 查询表单提交是否存在SQL入注攻击
CSB_NoSqlHack_ComeUrlPost = Request.Form
CSB_NoSqlHack_Str = Split(CSB_NoSqlHack_AllStr,"|")

'Post
If CSB_NoSqlHack_ComeUrlPost<>"" then
For Each CSB_NoSqlHack_Post In Request.Form
  For CSB_NoSqlHack_i = 0 To Ubound(CSB_NoSqlHack_Str)
   If Instr(LCase(CSB_NoSqlHack_ComeUrlPost),CSB_NoSqlHack_Str(CSB_NoSqlHack_i))<>0 Then
    'Response.Write("Error，请不要进行非法提交！")
    'Response.End
    Response.Write "<Script Language=JavaScript>alert('SQL通用防注入系统提示你↓\n\n请不要在参数中包含非法字符尝试注入！\n\nHttp://Www.Asduif.Com  系统版本:V1.0(ASP)版\n\nCoding By:Corin   Design By:Macdesign');</Script>"
    Response.Write "非法操作：系统做了如下记录↓<br>"
    Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
    Response.Write "操作时间："&Now&"<br>"
    Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
    Response.Write "提交方式：ＰＯＳＴ<br>"
    Response.Write "提交参数："&CSB_NoSqlHack_Post&"<br>"
    Response.Write "提交数据："&CSB_NoSqlHack_ComeUrlPost
    Response.End
   End if
  Next
Next
End if

'Get
If CSB_NoSqlHack_ComeUrlGet<>"" then
For Each CSB_NoSqlHack_Get In Request.QueryString
  For CSB_NoSqlHack_i = 0 To Ubound(CSB_NoSqlHack_Str)
  'Response.Write CSB_NoSqlHack_ComeUrlGet
  If Instr(LCase(CSB_NoSqlHack_ComeUrlGet),CSB_NoSqlHack_Str(CSB_NoSqlHack_i))<>0 Then
    'Response.Write("Error，请不要进行非法提交！")
    'Response.End
    Response.Write "<Script Language=JavaScript>alert('SQL通用防注入系统提示你↓\n\n请不要在参数中包含非法字符尝试注入！\n\nHttp://Www.Asduif.Com  系统版本:V1.0(ASP)版\n\nCoding By:Corin   Design By:Macdesign');</Script>"
    Response.Write "非法操作：系统做了如下记录↓<br>"
    Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
    Response.Write "操作时间："&Now&"<br>"
    Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
    Response.Write "提交方式：ＰＯＳＴ<br>"
    Response.Write "提交参数："&CSB_NoSqlHack_Get&"<br>"
    Response.Write "提交数据："&CSB_NoSqlHack_ComeUrlGet
    Response.End
  End if
  Next
Next
End if