Rem ## 長整數轉換 Function toNum(s, default) If IsNumeric(s) and s > "" then toNum = CLng(s) Else toNum = default End If End Function
Rem ## SQL 語句轉換 Function toSql(str) If IsNull(str) Then str = "" toSql = replace(str, "''", "''''") End Function
示例: Dim sql Dim strWhere, strName, intAge strName = toSql(request("user")) intAge = toNum(request("age"), 20) sql = "SELECT * FROM [USER]" _ "WHERE [AGE] > " strName _ " AND [USERNAME] = ''" intAge "''"
一般情況下, 通過上面兩個函數的過慮, 可以杜絕網上的SQL注入攻擊!如果你覺得有需要, 可以加上對chr(0)的替換, 將toSql函數改為如下: Function toSql(str) If IsNull(str) Then str = "" str = replace(str, chr(0), "") toSql = replace(str, "''", "''''") End Function
另注:
*********************************************************************** 檢測外部提交的函數 Function CheckUrlRefer() Dim strLocalUrl, intUrlLen, strUrlRefer strLocalUrl = "http://127.0.0.1" intUrlLen = Len(strLocalUrl) strUrlRefer = LCase(request.ServerVariables("HTTP_REFERER") "") ''檢測前一個頁面是否來自 strLocalUrl If Left(strUrlRefer, intUrlLen) = strLocalUrl Then CheckUrlRefer = True Else CheckUrlRefer = False End If End Function *********************************************************************** 該函數可以幫助你抵擋外部的SQL注入測試, 只需要在頁面的頭部調用即可.
dim qs,errc,iii qs=request.servervariables("query_string") dim nothis(18) nothis(0)="net user" nothis(1)="xp_cmdshell" nothis(2)="/add" nothis(3)="exec%20master.dbo.xp_cmdshell" nothis(4)="net localgroup administrators" nothis(5)="select" nothis(6)="count" nothis(7)="asc" nothis(8)="char" nothis(9)="mid" nothis(10)="''" nothis(11)=":" nothis(12)="""" nothis(13)="insert" nothis(14)="delete" nothis(15)="drop" nothis(16)="truncate" nothis(17)="from" nothis(18)="%" errc=false for iii= 0 to ubound(nothis) if instr(qs,nothis(iii))>0 then errc=true end if next if errc then Response.Write("對不起，非法URL地址請求!") response.end end if
% Function SafeRequest(ParaName,ParaType) ''--- 傳入參數 --- ''ParaName:參數名稱-字符型 ''ParaType:參數類型-數字型(1表示以上參數是數字，0表示以上參數為字符)
Dim ParaValue ParaValue=Request(ParaName) If ParaType=1 then If not isNumeric(ParaValue) then Response.write "參數" ParaName "必須為數字型！" Response.end End if Else ParaValue=replace(ParaValue,"''","''''") End if SafeRequest=ParaValue End function%>
