
<% 
'==================================
'=功    能：SQL防注入程序
'==================================
'--------定义部份------------------
Dim Ft_Post,Ft_Get,Ft_Cook,Ft_In,Ft_Inf,Ft_Xh,aa
'自定义需要过滤的字串,用 "|" 分隔
Ft_In = "'|and|exec|insert|delete|count|chr|mid|truncate|char|declare|alert|script"
Ft_Inf = split(Ft_In,"|")
'--------POST部份------------------
If Request.Form<>"" Then
	For Each Ft_Post In Request.Form
		For Ft_Xh=0 To Ubound(Ft_Inf)
			If Instr(LCase(Request.Form(Ft_Post)),Ft_Inf(Ft_Xh))<>0 Then
					Response.Write "<Script Language=JavaScript>alert('参数中包含非法字符！')</Script>"
					Response.Write "非法操作"
					Response.Write "<br><hr>"
					Response.Write "操作IP:"&Request.ServerVariables("REMOTE_ADDR")&"<br/>"
					Response.Write "操作时间:"&Now&"<br>"
					Response.Write "操作页面:"&Request.ServerVariables("URL")&"<br>"
					Response.Write "提交方式POST<br>"
					Response.Write "提交参数:"&Ft_Post&"<br>"
					Response.Write "提交数据:"&Request.Form(Ft_Post)
					Response.End
			End If
		Next
	Next
End If
'--------GET部份-------------------
If Request.QueryString<>"" Then
	For Each Ft_Get In Request.QueryString
		For Ft_Xh=0 To Ubound(Ft_Inf)
			If Instr(replace(LCase(Request.QueryString(Ft_Get)),"<br><li>",""),Ft_Inf(Ft_Xh))<>0 Then
					Response.Write "<script language=javascript>alert('参数中包含非法字符!')</script>"
					Response.Write "非法操作"
					Response.Write "<br><hr>"
					Response.Write "操作IP:"&Request.ServerVariables("REMOTE_ADDR")&"<br>"
					Response.Write "操作时间:"&Now&"<br>"
					Response.Write "操作页面:"&Request.ServerVariables("URL")&"<br>"
					Response.Write "提交方式GET<br>"
					Response.Write "提交参数:"&Ft_Get&"<br>"
					Response.Write "提交数据:"&Request.QueryString(Ft_Get)
					Response.End
			End If
		Next
	Next
End If
%>