<%@LANGUAGE="VBSCRIPT"%> <%response.buffer=true%> <% 'WinMyDNS数据库链接参数,请在这里手工修改 '############################################################################################## WinMyDNSDbType="0" '数据为类型,0:Access,1:mssql数据库 WInMyDNSAccessFile="../DB/WinMyDNS.MDB" 'Access数据库文件名 WinMyDNSDbIP = "127.0.0.1" 'WINIIS_Server 数据库IP地址 WinMyDNSDbName="WinMyDNS" 'WINIIS_Server 数据库名 WinMyDNSDbUser="WinMyDNS" 'WINIIS_Server 数据库用户名 WinMyDNSDbPass="linyang" 'WINIIS_Server 数据库密码 WinMyDNSURL="url.winmydns.com" 'winmydns URL转发服务器的域名 '############################################################################################## PageCount = "10" Set conn = Server.CreateObject("ADODB.Connection") if WinMyDNSDbType ="1" then connstr="Provider=SQLOLEDB.1; Persist Security Info=True; Data Source="&WinMyDNSDbIP&"; Initial Catalog="&WinMyDNSDbName&"; User ID="&WinMyDNSDbUser&"; Password="&WinMyDNSDbPass else connstr="DBQ="+Server.Mappath(WInMyDNSAccessFile)+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" end if conn.Open connstr SQL_injdata = "'|exec |insert |select |update |delete |set |xp_cmdshell |exec master|xp_dirtree |exec master |char |net localgroup administrators | and |net user | or |mid( |asc( |truncate " SQL_inj = split(SQL_Injdata,"|") If Request.QueryString<>"" Then For Each SQL_Get In Request.QueryString For SQL_Data=0 To Ubound(SQL_inj) if instr(lcase(Request.QueryString(SQL_Get)),Sql_Inj(Sql_DATA))>0 Then response.write "输入非法" Response.end end if next Next End If If Request.Form<>"" Then For Each Sql_Post In Request.Form For SQL_Data=0 To Ubound(SQL_inj) if instr(lcase(Request.Form(Sql_Post)),Sql_Inj(Sql_DATA))>0 Then response.write "输入非法" Response.end end if next next end if 'SQL防入库函数 Function SafeRequest(ParaName) Dim ParaValue ParaValue=request(ParaName) if ParaValue = "" then SafeRequest = "" exit function end if '过虑非法字符 ParaValue = replace(ParaValue,"'","") ParaValue = replace(ParaValue,"select ","") ParaValue = replace(ParaValue,"insert ","") ParaValue = replace(ParaValue,"delete ","") ParaValue = replace(ParaValue,"count(","") ParaValue = replace(ParaValue,"drop table ","") ParaValue = replace(ParaValue,"update ","") ParaValue = replace(ParaValue,"truncate ","") ParaValue = replace(ParaValue,"asc(","") ParaValue = replace(ParaValue,"mid(","") ParaValue = replace(ParaValue,"char(","") ParaValue = replace(ParaValue,"xp_cmdshell","") ParaValue = replace(ParaValue,"exec master","") ParaValue = replace(ParaValue,"net localgroup administrators","") ParaValue = replace(ParaValue," and ","") ParaValue = replace(ParaValue,"net user","") ParaValue = replace(ParaValue," or ","") SafeRequest=ParaValue 'if IsNumeric(ParaValue) = True then 'SafeRequest=ParaValue 'exit Function 'elseIf Instr(LCase(ParaValue),"select ") > 0 or Instr(LCase(ParaValue),"insert ") > 0 or Instr(LCase(ParaValue),"delete from") > 0 or Instr(LCase(ParaValue),"count(") > 0 or Instr(LCase(ParaValue),"drop table") > 0 or Instr(LCase(ParaValue),"update ") > 0 or Instr(LCase(ParaValue),"truncate ") > 0 or Instr(LCase(ParaValue),"asc(") > 0 or Instr(LCase(ParaValue),"mid(") > 0 or Instr(LCase(ParaValue),"char(") > 0 or Instr(LCase(ParaValue),"xp_cmdshell") > 0 or Instr(LCase(ParaValue),"exec master") > 0 or Instr(LCase(ParaValue),"net localgroup administrators") > 0 or Instr(LCase(ParaValue)," and ") > 0 or Instr(LCase(ParaValue),"net user") > 0 or Instr(LCase(ParaValue)," or ") > 0 then 'Response.Write " <% response.end end sub function Alert_Redirect(Mesg,this_url) if isnull(Mesg) then Mesg="" Mesg=Replace(Mesg,"\","") Mesg=Replace(Mesg,"/","") Mesg=Replace(Mesg,"'","") Mesg=Replace(Mesg,"&","") Mesg=Replace(Mesg,vbcrlf,"") Mesg=Replace(Mesg,vbcr,"") Mesg=Replace(Mesg,vblf,"") Mesg=Replace(Mesg,"""","") %> <% response.end end function Function CheckIp(paR_strIp) CheckIp= 0 for each str_i in split(paR_strIp,",") CheckIp = CheckIp_in(str_i) if CheckIp<>0 then exit function next end function Function CheckIp_in(paR_strIp) CheckIp_in =-1 Dim tmpLoop, tmpStr tmpStr =paR_strIp If tmpStr ="" or IsNull(tmpStr) Then Exit Function tmpStr =Split(tmpStr, ".") If Not isArray(tmpStr) Then Exit Function For tmpLoop =0 To ubound(tmpStr) If tmpStr(tmpLoop) ="" or IsNull(tmpStr(tmpLoop)) Then Exit Function If Not isNumeric(tmpStr(tmpLoop)) Then Exit Function if len(tmpStr(tmpLoop))>3 then Exit Function If Cint(tmpStr(tmpLoop)) >255 or Cint(tmpStr(tmpLoop)) <0 Then Exit Function Next CheckIp_in =0 End Function function checkDomain(paR_strDomain) checkDomain = -1 if CheckIp(paR_strDomain)=0 then exit function Dim tmpLoop, tmpStr tmpStr =paR_strDomain If tmpStr ="" or IsNull(tmpStr) Then Exit Function tmpStr =Split(tmpStr, ".") If Not isArray(tmpStr) Then Exit Function For tmpLoop =0 To ubound(tmpStr) For i = 1 To Len(tmpStr(tmpLoop)) ThisChr = Mid(tmpStr(tmpLoop), i, 1) If (Abs(Asc(ThisChr)) >= &HFF) or ( (Asc(ThisChr)>47 and Asc(ThisChr)<58) or (Asc(ThisChr)>64 and Asc(ThisChr)<91) or (Asc(ThisChr)>96 and Asc(ThisChr)<123) or (Asc(ThisChr)=45)) then else exit function end if Next Next checkDomain =0 end function function checkSrv(paR_strDomain) checkSrv = -1 if instr(paR_strDomain,":") then else checkSrv = -1 exit function end if paR_strDomainA = split(paR_strDomain,":") if checkDomain(paR_strDomainA(0))<>"0" then exit function if len(paR_strDomainA(1))<1 then exit function if len(paR_strDomainA(1))>5 then exit function if isnumeric(paR_strDomainA(1)) then else exit function end if checkSrv =0 end function %>