1、sql安全檢測函數(shù)
function checkstr(str,strtype)
dim strtmp
strtmp = ""
if strtype ="s" then
strtmp = replace(trim(str),"'","''")
strtmp = replace(strtmp,";","")
elseif strtype="i" then
if isnumeric(str)=false then str=false
strtmp = str
else
strtmp = str
end if
checkstr= strtmp
end function

把這函數(shù)放在你頁面代碼里，你的接收參數(shù)可以這樣寫
<%
yxzy=checkstr(request("yxzy"),"s")
%>

上面是指字符串型，如果你的參數(shù)是數(shù)字型，比方id
<%
id=request("id")
%>
那么安全的，你可以這么寫：
yxzy=checkstr(request("yxzy"),"i")

2、過濾用戶名中的非法字符
function dealusername(username_)
dim regexpobj
dim i,n
dim username,tempstr,resultstr

username=trim(username_)
set regexpobj=new regexp
regexpobj.global = true
regexpobj.pattern="^[a-za-z0-9_]+$" '只允許字母、數(shù)字和下劃線
'regexpobj.pattern="^\w+$" '效果同上

resultstr=username
n=len(username)
for i=1 to n
tempstr=mid(username,i,1)
if not regexpobj.test(tempstr) then resultstr=replace(resultstr,tempstr,"")
next

set regexpobj=nothing
dealusername=resultstr
end function

3、防注入的安全request函數(shù)
function saferequest(paraname,paratype)
'--- 傳入?yún)?shù) ---
'paraname:參數(shù)名稱-字符型
'paratype:參數(shù)類型-數(shù)字型(1表示以上參數(shù)是數(shù)字，0表示以上參數(shù)為字符)

dim paravalue
paravalue=request(paraname)
if paratype=1 then
if not isnumeric(paravalue) then
response.write "參數(shù)" & paraname & "必須為數(shù)字型！"
response.end
end if
else
paravalue=replace(paravalue,"'","''")
end if
saferequest=paravalue
end function

4、外部連接進入網(wǎng)站
<% dim refurl
refurl = request.servervariables("http_referer")
if refurl <> "" and instr(refurl,request.servervariables("server_name")) = 0 then
response.write("進入網(wǎng)站首頁")
response.end()
end if %>
防止從外部連接進入網(wǎng)站，也可以防止被iframe

5、iis設(shè)置
sql注入入侵是根據(jù)iis給出的asp錯誤提示信息來入侵的，如果你把iis設(shè)置成不管出什么樣的asp錯誤，只給出一種錯誤提示信息，即http 500錯誤，那么人家就沒辦法入侵了。具體設(shè)置請參看圖2。主要把500:100這個錯誤的默認提示頁面 c:\windows\help\iishelp\common\500-100.asp改成
c:\windows\help\iishelp\common\500.htm即可，這時，無論asp運行中出什么錯，服務(wù)器都只提示http 500錯誤。

6、篩選掉不必要的sql語句
<%
'使用說明:在數(shù)據(jù)庫連接頁(如:conn.asp)或你要防注入的頁頭內(nèi)包含此文件即可。<!--@include file="cf_sql.asp"-->(將@改為#)

dim cfsql_i,cfsql_sqlchr,cfsql_chrcontent
cfsql_sqlchr = "select*|and'|or'|insertinto|deletefrom|altertable|update|createtable|createview|dropview|createindex|dropindex|createprocedure|dropprocedure|createtrigger|droptrigger|createschema|dropschema|createdomain|alterdomain|dropdomain|);|select@|declare@|print@|char(|select"
cfsql_sqlchrs = split(cfsql_sqlchr,"|")

'======================================================
'post方式處理
'======================================================
if request.form<>"" then
for each cfsql_chrcontent in request.form
for cfsql_i=0 to ubound(cfsql_sqlchrs)
select case cfsql_sqlchrs(cfsql_i)
case "select"'為避免select的多表關(guān)聯(lián)查詢
if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"select")>0 and instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"from")>0 then
call cfsql_prompttitle()
end if
case "update"'update作額外處理,因update..set..
if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"update")>0 and instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"set")>0 then
call cfsql_prompttitle()
end if
case else
if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),cfsql_sqlchrs(cfsql_i))>0 then
call cfsql_prompttitle()
end if
end select
next
next
end if

'======================================================
'get方式處理
'======================================================
if request.querystring<>"" then
for each cfsql_chrcontent in request.querystring
for cfsql_i=0 to ubound(cfsql_sqlchrs)
select case cfsql_sqlchrs(cfsql_i)
case "select"'為避免select的多表關(guān)聯(lián)查詢
if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"select")>0 and instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"from")>0 then
call cfsql_prompttitle()
end if
case "update"'update作額外處理,因update..set..
if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"update")>0 and instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"set")>0 then
call cfsql_prompttitle()
end if
case else
if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),cfsql_sqlchrs(cfsql_i))>0 then
call cfsql_prompttitle()
end if
end select
next
next
end if

%>