<%
dim conn,ConnectionString,Itmes,IItems,ParaValue
'ConnectionString = "Provider=SQLOLEDB.1;Persist Security Info=False;User ID=sa; Password=sa; Initial Catalog=xicms-demo1;Data Source=127.0.0.1"
'ConnectionString="dsn=asb;uid=asb;pwd=asb(web)@2005!"
'ConnectionString="dsn=asb;uid=asb;pwd=asb(web)@2005!"
ConnectionString="Provider=SQLOLEDB.1;Persist Security Info=False;User ID=sab; Password=asb@!^&mile; Initial Catalog=asb;Data Source=127.0.0.1"
Set conn=Server.CreateObject("ADODB.Connection")
conn.ConnectionString=ConnectionString
conn.open
'Set conn = Server.CreateObject("ADODB.Connection")
'conn.ConnectionString = ConnectionString
'response.write ConnectionString
'response.end
'conn.Open
Function sqlEscape(str)
sqlEscape = replace(str,"'","''")
End function
'************** ASPSecurity SQL 防注入**************
' Copyright 2006
' Create:2006-11-09
' Update:2006-11-10
' CreateUser:Jack
'***************************************************
If Request.Cookies("IpLock")="True" Then
'Call Alert("注意
对不起,您的IP被封杀,请稍候访问")
End If
For Each Itmes In Split(Request.QueryString,"&")
I=0
For Each ParaValue In Split(Trim(Itmes),"=")
If I=1 Then
Call Check()
End If
I = I + 1
NExt
Next
For Each IItems in Request.Form
ParaValue=Request(IItems)
Check()
Next
Sub Alert(Str)
Response.Write Str
Response.Cookies("IpLock")="True"
Response.Cookies("IpLock").Expires=Date + 1
Response.Write "
页面将在5秒后自动关闭"
Response.End
End Sub
Sub Check()
If Instr(LCase(ParaValue),",") > 0 Or Instr(LCase(ParaValue),"'") > 0 Or Instr(LCase(ParaValue),"select") > 0 or Instr(LCase(ParaValue),"insert") > 0 or Instr(LCase(ParaValue),"delete from") > 0 or Instr(LCase(ParaValue),"count(") > 0 or Instr(LCase(ParaValue),"drop table") > 0 or Instr(LCase(ParaValue),"update") > 0 or Instr(LCase(ParaValue),"truncate") > 0 or Instr(LCase(ParaValue),"asc(") > 0 or Instr(LCase(ParaValue),"mid(") > 0 or Instr(LCase(ParaValue),"char(") > 0 or Instr(LCase(ParaValue),"xp_cmdshell") > 0 or Instr(LCase(ParaValue),"exec master") > 0 or Instr(LCase(ParaValue),"net localgroup administrators") > 0 or Instr(LCase(ParaValue),"and") > 0 or Instr(LCase(ParaValue),"net user") > 0 or Instr(LCase(ParaValue),"or") > 0 then
Call Alert("注意
试图进行恶意肉机注射,失败")
End If
End Sub
%>
|
|
