<%

'該文件可以包含在任何需要調用數據庫的ASP文件頭部,直接過慮掉非法注入 

'調用方法為:<!-- #include file="chkstr.asp" --> 



Function Safe(str)'該函數用來判斷傳遞過來的變量是否包含特殊字符,沒有返回TRUE 

Dim s_BadStr, n, i 

s_BadStr = "' 　&<>?%,;:()`~!@#$^*{}[]|\/+-="&Chr(34)&Chr(9)&Chr(32) 

n = Len(s_BadStr) 

Safe = True 

For i = 1 To n 

If Instr(str, Mid(s_BadStr, i, 1)) > 0 Then 

Safe = False 

Exit Function 

End If 

Next 

End Function 

'以下代碼直接判斷發生請求的URL是否包含非法字符 

On Error Resume Next 

Dim strTemp 



If LCase(Request.ServerVariables("HTTPS")) = "off" Then 

strTemp = "http://" 

Else 

strTemp = "https://" 

End If 

strTemp = strTemp & Request.ServerVariables("SERVER_NAME") 

If Request.ServerVariables("SERVER_PORT") <> 80 Then strTemp = strTemp & ":" & Request.ServerVariables("SERVER_PORT") 

strTemp = strTemp & Request.ServerVariables("URL") 

If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & Trim(Request.QueryString) 

strTemp = LCase(strTemp) 

If Instr(strTemp,"select%20") or Instr(strTemp,"insert%20") or Instr(strTemp,"delete%20from") or Instr(strTemp,"count(") or Instr(strTemp,"drop%20table") or Instr(strTemp,"update%20") or Instr(strTemp,"truncate%20") or Instr(strTemp,"asc(") or Instr(strTemp,"mid(") or Instr(strTemp,"char(") or Instr(strTemp,"xp_cmdshell") or Instr(strTemp,"exec%20master") or Instr(strTemp,"net%20localgroup%20administrators") or Instr(strTemp,"db_name(") or Instr(strTemp,"net%20user") or Instr(strTemp,"'") or Instr(strTemp,"%20or") or Instr(strTemp,"backup%20") then 

Response.Write "<script language='javascript'>" 

Response.Write "alert('非法地址,單擊確定返回首頁。');" 

Response.Write "location.href='/Index.asp';" 

Response.Write "</script>" 

End If 



For Each name In Request.Form 

Dim s_BadStr, s_Sz, i 

s_BadStr = "'|and|select|update|chr|delete|from|;|insert|mid|master.|truncate|db_name|xp_cmdshell|exec%20master|net%20localgroup%20administrators|drop|table|db_name(|exec" 

s_Sz = split(s_BadStr,"|") 

For i = 0 To ubound(s_Sz) 

If Instr(Request.Form(name), s_Sz(i)) > 0 Then 

Response.Write "<script language='javascript'>" 

Response.Write "alert('非法地址,單擊確定返回首頁。');" 

Response.Write "location.href='/Index.asp';" 

Response.Write "</script>" 

End If 

Next 

next 

%>