在接出数据的时候使用函数检测,
Function SafeRequest(ParaName,ParaType)
'--- 传入参数 ---
'ParaName:参数名称-字符型
'ParaType:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符)
Dim ParaValue
ParaValue=Request(ParaName)
If ParaType=1 then
If ParaValue="" or not isNumeric(ParaValue) then
Response.write "参数" & ParaName & "必须为数字型！"
Response.end
End if
Else
ParaValue=replace(ParaValue,"'","'+ char(39) + '")
End if
SafeRequest=ParaValue
End function
方法二:
在链接数据库的文件中加入如下代码:
On Error Resume Next
dim sql_leach,sql_leach_0,Sql_DATA,SQL_Get,Sql_Post
sql_leach = "',and,exec,insert,select,delete,%,*,update,count,chr,mid,master,truncate,char,declare"
sql_leach_0 = split(sql_leach,",")
If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
For SQL_Data=0 To Ubound(sql_leach_0)
if instr(Request.QueryString(SQL_Get),sql_leach_0(Sql_DATA))>0 Then
Response.Write "请不要在参数中使用',and,insert,select,delete等字符！"
Response.end
end if
next
Next
End If
If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For SQL_Data=0 To Ubound(sql_leach_0)
if instr(Request.Form(Sql_Post),sql_leach_0(Sql_DATA))>0 Then
Response.Write "请不要在参数中使用',and,insert,select,delete等字符！"
Response.end
end if
next
next
end if
"作者: z1b6j0u8v4j 时间: 2010-11-18 20:08
