ASP防SQL 注入漏洞检查函数

开新窗口(view plain)复制(copy to clipboard)打印(print)关于(about)

' ============================================
' SQL 注入漏洞检查
' 每一页开头进行测试
' ============================================
Function CHECK_SQLCODE(sqlValue)
Dim strTemp
If LCase(Request.ServerVariables("HTTPS")) = "off" Then
strTemp = "http://"
Else
strTemp = "https://"
End If
strTemp = strTemp & Request.ServerVariables("SERVER_NAME")
If Request.ServerVariables("SERVER_PORT") <> 80 Then
strTemp = strTemp & ":" & Request.ServerVariables("SERVER_PORT")
End If
strTemp = strTemp & Request.ServerVariables("URL")
If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & Trim(Request.QueryString)
strTemp = LCase(strTemp)
If Instr(strTemp, "select%20") _
Or Instr(strTemp,"insert%20") _
Or Instr(strTemp, "delete%20from") _
Or Instr(strTemp, "count(") _
Or Instr(strTemp, "drop%20table") _
Or Instr(strTemp, "update%20") _
Or Instr(strTemp, "truncate%20") _
Or Instr(strTemp, "asc(") _
Or Instr(strTemp, "mid(") _
Or Instr(strTemp, "char(") _
Or Instr(strTemp, "xp_cmdshell") _
Or Instr(strTemp, "exec%20master") _
Or Instr(strTemp, "net%20localgroup%20administrators") _
Or Instr(strTemp, "net%20user") _
Or Instr(strTemp, "'") _
Or Instr(strTemp, "%20or%20") Then
'非法地址
CHECK_SQLCODE = False
Else
CHECK_SQLCODE = True
End If
End Function