f_sql.asp

更新说明： 1.修复SQL注入 2.防止数据库被恶意下载

<%
Dim f_sqlPost,f_sqlGet,f_sqlIn,f_sqlInf,f_sqlXh,f_sqldb,f_sqldbstr
f_sqlIn = "'\;\and\exec\insert\select\delete\update\count\*\%\chr\mid\master\truncate\char\declare"
f_sqlInf = split(f_sqlIn,"\")
If Request.Form<>"" Then
For Each f_sqlPost In Request.Form
For f_sqlXh=0 To Ubound(f_sqlInf)
If Instr(LCase(Request.Form(f_sqlPost)),f_sqlInf(f_sqlXh))<>0 Then
response.redirect("error.asp?error=4")
Response.End
End If
Next
Next
End If
If Request.QueryString<>"" Then
For Each f_sqlGet In Request.QueryString
For f_sqlXh=0 To Ubound(f_sqlInf)
If Instr(LCase(Request.QueryString(f_sqlGet)),f_sqlInf(f_sqlXh))<>0 Then
response.redirect("error.asp?error=4")
Response.End
End If
Next
Next
End If
%>