日期:2014-05-16 浏览次数:21155 次
Dim sql_injdata,Sql_Inj,SQL_Get,Sql_Post,Sql_DATA
sql_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
Sql_Inj = Split(SQL_Injdata, "|")
Response.Write Sql_Inj
If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For Sql_DATA = 0 To UBound(SQL_inj)
Response.write ("<script>alert('"&Request.Form(Sql_Post)&"!');</script>")
Response.Write Request.Form(Sql_Post)
Response.Write Sql_Inj(Sql_DATA)
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then
'If instr(Request.Form(Sql_Post),SQL_inj(SQL_Data))>0 Then
Response.Write "<Script>alert('系统提示请不要在参数中包含非法字符尝试注入!')</Script>"
Response.End
End If
Next
Next
End If