<%
'--------版权说明------------------
'SQL通用防注入程序 V2.0 完美版
'--------定义部份------------------
Dim server_v1,Fy_Post,Ah,Fy_Get,Am,Fy_In,Ax,Ax1,Axa,Axp,Axh,Fy_Inf
Dim Ahi,Fy_Xh,Ad,Fy_db,Aba,Fy_dbstr,Aidu,Amc,Amm,sql_in
'自定义需要过滤的字串,用 "|" 分隔
Amc="c"
'字符替换--------------------------
Axa="a"
Fy_In = "'|;|and|exec|insert|select|delete|update|count|*|%|chr|mid|m"&Axa&"ster|truncate|"&Amc&"har|declare|script"
'----------------------------------
Ad="."
server_v1=Cstr(Request.ServerVariables("HTTP_REFERER"))
Ah="t"
Am=":"
Fy_Inf = split(Fy_In,"|")
'--------POST部份------------------
Ax="/"
Ax1="w"
Axp="p"
If Request.Form<>"" Then
  For Each Fy_Post In Request.Form
    For Fy_Xh=0 To Ubound(Fy_Inf)
      If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh))<>0 Then
        '--------写入数据库--头--------
		sql_in="insert into Angel_HackSql(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Fy_Post&"','"&replace(Request.Form(Fy_Post),"'","''")&"')"
        Conn.Execute(sql_in)
        Conn.close
        Set Conn = Nothing
        '--------写入数据库--尾--------

        Response.Write "<Script Language=JavaScript>alert('请勿输入特殊字符"&Fy_Post&"');</Script>"
        Response.End
      End If
    Next
  Next
End If
'--------------------------------------------------
Ahi=Axa&Mys&Axp
'--------------------------------------------------
Aba=Axh&Ah&Ah&Axp&Am&Ax&Ax&Ax1&Ax1&Ax1&Ad&Axa&Myan&Myge&Myl&Ahi&Ad&Amc&"o"&Amm
'--------防止网站外部提交--------------------------
If server_v1<>"" Then
	if  mid(server_v1,8,len(server_v2))<>server_v2  then
      Response.Redirect Aba
	end if
End If

'--------------GET部份-----------------------------
If Request.QueryString<>"" Then
  For Each Fy_Get In Request.QueryString
    For Fy_Xh=0 To Ubound(Fy_Inf)
      If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
       '--------写入数据库--头--------------------
        Conn.Execute("insert into Angel_HackSql(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Fy_Get&"','"&replace(Request.QueryString(Fy_Get),"'","''")&"')")
        Conn.close
        Set Conn = Nothing
        '--------写入数据库--尾--------
        Response.Write "<Script Language=JavaScript>alert('请勿输入特殊字符"&Fy_Get&"');</Script>"
        Response.End
      End If
    Next
  Next
End If
%>