将以下代码加在 数据库操作之前
<%
dim sql_injdata
SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
sql_inj = split(SQL_Injdata,"|")
if request.QueryString<>"" then
for each sql_get in request.QueryString
for sql_data=0 to ubound(sql_inj)
if instr(request.QueryString(sql_get),sql_inj(sql_data))>0 then
response.Write("<script>alert('go home!');history.back(-1);</script>")
response.End()
end if
next
next
end if
if request.Form<>"" then
for each sql_get in request.Form
for sql_data=0 to ubound(sql_inj)
if instr(request.QueryString(sql_get),sql_inj(sql_data))>0 then
response.Write("<script>alert('go home!');history.back(-1);</script>")
response.End()
end if
next
next
end if
%>