<% 
'**************************************************************
'ASP禁止外部提交
'**************************************************************
public function limit_submit()
dim server_v1,server_v2
	server_v1=Cstr(Request.ServerVariables("HTTP_REFERER"))   '得到访问的上一页的Url
	server_v2=Cstr(Request.ServerVariables("SERVER_NAME"))
	if  mid(server_v1,8,len(server_v2))<>server_v2  then
		Response.Redirect "/"
		Response.end
	end if
end function
'**************************************************************'
'ASP+ACCESS防sql注入攻击 get post注入
'************************************************************** 
public function limit_sql_inject()
  dim sql_injdata,SQL_inj,SQL_GET,SQL_Data,SQL_Post
	SQL_injdata = "'|and|or|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 
	SQL_inj = split(SQL_Injdata,"|") 
		If Request.QueryString<>"" Then
			For Each SQL_GET In Request.QueryString                                   'For Each...Next 语句针对一个数组或集合中的每个元素，重复执行一组语句。
			  For SQL_Data=0 To Ubound(SQL_inj)                                         'Ubound返回一个 Long 型数据，其值为指定的数组维可用的最大下标。 
				  if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then           'instr函数返回要截取的字符串在源字符串中的位置
					  Response.Write ("<Script>alert('请不要在参数中包含非法字符！');history.back(-1)</Script>" ) 
					  Response.end 
				  end if 
			  next 
			Next 
			For Each SQL_Post In Request.Form                                        'For Each...Next 语句针对一个数组或集合中的每个元素，重复执行一组语句。
				For SQL_Data=0 To Ubound(SQL_inj)                                        'Ubound返回一个 Long 型数据，其值为指定的数组维可用的最大下标。 
					if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then                'instr函数返回要截取的字符串在源字符串中的位置
					Response.Write ("<Script>alert('请不要在参数中包含非法字符!');history.back(-1)</Script>" )  
					Response.end 
					end if 
				next 
			next 
		end if 
end function
'======================================================================================
'修补跨站脚本攻击漏洞
'======================================================================================
public function limit_attact()
	  'Code by safe3
	  On Error Resume Next
	  if request.querystring<>"" then call stophacker(request.querystring,"'|\b(alert|confirm|prompt)\b|<[^>]*?>|^\+/v(8|9)|\bonmouse(over|move)=\b|\b(and|or)\b.+?(>|<|=|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
	  if Request.ServerVariables("HTTP_REFERER")<>"" then call test(Request.ServerVariables("HTTP_REFERER"),"'|\b(and|or)\b.+?(>|<|=|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
	  if request.Cookies<>"" then call stophacker(request.Cookies,"\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)") 
	  call stophacker(request.Form,"^\+/v(8|9)|\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|<\s*img\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
end function


public function test(values,re)
  dim regex
  set regex=new regexp
  regex.ignorecase = true
  regex.global = true
  regex.pattern = re
	if regex.test(values) then
		IP=Request.ServerVariables("HTTP_X_FORWARDED_FOR")
			If IP = "" Then 
			  IP=Request.ServerVariables("REMOTE_ADDR")
			end if
	   'slog("<br><br>操作IP: "&ip&"<br>操作时间: " & now() & "<br>操作页面："&Request.ServerVariables("URL")&"<br>提交方式: "&Request.ServerVariables("Request_Method")&"<br>提交参数: "&l_get&"<br>提交数据: "&l_get2)
		  Response.Write("<div style='position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;'><br>您的提交带有不合法参数,谢谢合作!<br></div>")
		  Response.end
	 end if
   set regex = nothing
end function 


public function stophacker(values,re)
 dim l_get, l_get2,n_get,regex,IP
 for each n_get in values
  for each l_get in values
   l_get2 = values(l_get)
   set regex = new regexp
   regex.ignorecase = true
   regex.global = true
   regex.pattern = re
   if regex.test(l_get2) then
	  IP=Request.ServerVariables("HTTP_X_FORWARDED_FOR")
	  If IP = "" Then 
		IP=Request.ServerVariables("REMOTE_ADDR")
	  end if
                                'slog("<br><br>操作IP: "&ip&"<br>操作时间: " & now() & "<br>操作页面："&Request.ServerVariables("URL")&"<br>提交方式: "&Request.ServerVariables("Request_Method")&"<br>提交参数: "&l_get&"<br>提交数据: "&l_get2)
    Response.Write("<div style='position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;'><br>您的提交带有不合法参数,谢谢合作!</div>")
    Response.end
   end if
   set regex = nothing
  next
 next
end function 

public function slog(logs)
        dim toppath,fs,Ts
        toppath = Server.Mappath("/")
		Set fs = CreateObject("scripting.filesystemobject")
			If Not Fs.FILEEXISTS(toppath) Then 
				Set Ts = fs.createtextfile(toppath, True)
				Ts.close
			end if
		Set Ts= Fs.OpenTextFile(toppath,8)
		Ts.writeline (logs)
		Ts.Close
		Set Ts=nothing
		Set fs=nothing
end function
 %>
 <% 
 'call limit_submit()
 'call limit_sql_inject()
 'call limit_attact()
  %>