ASP中过滤SQL命令字符

function POP_sqlin(text)
   if isnull(text) then
     POP_sqlin=""
     exit function
   end if

   dim Sqlwords
   Set Sqlwords=new RegExp
   Sqlwords.IgnoreCase =True
   Sqlwords.Global=True

   Sqlwords.Pattern="(')"
   text=Sqlwords.Replace(text,"''")
   Sqlwords.Pattern="(;)"
   text=Sqlwords.Replace(text,"；")
   Sqlwords.Pattern="(%)"
   text=Sqlwords.Replace(text,"％")
   Sqlwords.Pattern="(and)"
   text=Sqlwords.Replace(text,"ａｎｄ")
   Sqlwords.Pattern="(exec)"
   text=Sqlwords.Replace(text,"ｅｘｅｃ")
   Sqlwords.Pattern="(execute)"
   text=Sqlwords.Replace(text,"ｅｘｅｃｕｔｅ")
   Sqlwords.Pattern="(insert)"
   text=Sqlwords.Replace(text,"ｉｎｓｅｒｔ")
   Sqlwords.Pattern="(select)"
   text=Sqlwords.Replace(text,"ｓｅｌｅｃｔ")
   Sqlwords.Pattern="(delete)"
   text=Sqlwords.Replace(text,"ｄｅｌｅｔｅ")
   Sqlwords.Pattern="(update)"
   text=Sqlwords.Replace(text,"ｕｐｄａｔｅ")
   Sqlwords.Pattern="(count)"
   text=Sqlwords.Replace(text,"ｃｏｕｎｔ")
   Sqlwords.Pattern="(chr)"
   text=Sqlwords.Replace(text,"ｃｈｒ")
   Sqlwords.Pattern="(mid)"
   text=Sqlwords.Replace(text,"ｍｉｄ")
   Sqlwords.Pattern="(master)"
   text=Sqlwords.Replace(text,"ｍａｓｔｅｒ")
   Sqlwords.Pattern="(truncate)"
   text=Sqlwords.Replace(text,"ｔｒｕｎｃａｔｅ")
   Sqlwords.Pattern="(char)"
   text=Sqlwords.Replace(text,"ｃｈａｒ")
   Sqlwords.Pattern="(declare)"
   text=Sqlwords.Replace(text,"ｄｅｃｌａｒｅ")

   Set Sqlwords=Nothing
   POP_sqlin = text
end function

function POP_sqlout(text)
   if isnull(text) then
     POP_sqlout=""
     exit function
   end if
   text = Replace(text,"''","'")
   text = Replace(text,"；",";")
   text = Replace(text,"％","%")
   text = Replace(text,"ａｎｄ","and")
   text = Replace(text,"ｅｘｅｃ","exec")
   text = Replace(text,"ｅｘｅｃｕｔｅ","execute")
   text = Replace(text,"ｉｎｓｅｒｔ","insert")
   text = Replace(text,"ｓｅｌｅｃｔ","select")
   text = Replace(text,"ｄｅｌｅｔｅ","delete")
   text = Replace(text,"ｕｐｄａｔｅ","update")
   text = Replace(text,"ｃｏｕｎｔ","count")
   text = Replace(text,"ｃｈｒ","chr")
   text = Replace(text,"ｍｉｄ","mid")
   text = Replace(text,"ｍａｓｔｅｒ","master")
   text = Replace(text,"ｔｒｕｎｃａｔｅ","truncate")
   text = Replace(text,"ｃｈａｒ","char")
   text = Replace(text,"ｄｅｃｌａｒｅ","declare")
   POP_sqlout = text
end function

function HTMLEncode(popstring)
   if not isnull(popstring) then
   popstring = POP_sqlout(popstring)
   popstring = replace(popstring, ">", ">")
   popstring = replace(popstring, "<", "<")
   popstring = Replace(popstring, CHR(32), " ")
   popstring = Replace(popstring, CHR(9), " ")
   popstring = Replace(popstring, CHR(34), """)
   popstring = Replace(popstring, CHR(39), "'")
   popstring = Replace(popstring, CHR(10) & CHR(10), "

")
   popstring = Replace(popstring, CHR(10), "
")
   popstring = Replace(popstring, CHR(36), "$")
   HTMLEncode = popstring
   end if
end function


使用方法：
把需要过滤的提交信息改为POP_sqlin(提交的信息)即可
在需要把信息还原时改为：Htmlencode(提交的信息)即可

上一篇: SQL替换挂马命令
下一篇: "无限流"分页程序，终于调试成功
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags:
相关日志: