<%
Dim FrSql_Post,FrSql_Get,FrSql_In,FrSql_Inf,FrSql_Xh,Kill_IP,WriteSql
'自定义需要过滤的字串,用 "|" 分隔
FrSql_In = "'|*|and |exec |or |insert |select |delete |update |count |master |truncate |declare |and	|exec	|insert	|select	|delete	|update	|count	|master	|truncate	|declare	|char(|mid(|chr(|and[|exec[|insert[|select[|delete[|update[|count[|master[|truncate[|declare[|set[|set |set	|where[|where |where	|xp_cmdshell|xp_cmdshell |xp_cmdshell	"
Kill_IP=True
WriteSql=True
FrSql_Inf = split(FrSql_In,"|")
Sub SQLin()
If FR_HR_Sql = True Then
	'防止Post方法注入 
	If Request.Form<>"" Then
		For Each FrSql_Post In Request.Form
		For FrSql_Xh=0 To Ubound(FrSql_Inf)
		If Instr(LCase(Request.Form(FrSql_Post)),FrSql_Inf(FrSql_Xh))<>0 Then
		If WriteSql=True Then
			conn.Execute("insert into job_errlog(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_time,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&FrSql_Post&"','"&now()&"','"&replace(Request.Form(FrSql_Post),"'","''")&"')")
			conn.close
			Set conn = Nothing
		End If
		Response.Write "<Script Language=javascript>alert('请不要在参数中包含非法字符尝试注入');history.back(-1)</Script>"  
		Response.end
		End If
		Next
		Next
	End If
	'防止Get方法注入
	If Request.QueryString<>"" Then
		For Each FrSql_Get In Request.QueryString
		For FrSql_Xh=0 To Ubound(FrSql_Inf)
		If Instr(LCase(Request.QueryString(FrSql_Get)),FrSql_Inf(FrSql_Xh))<>0 Then
		If WriteSql=True Then
			conn.Execute("insert into job_errlog(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_time,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&FrSql_Get&"','"&now()&"','"&replace(Request.QueryString(FrSql_Get),"'","''")&"')")
			conn.close
			Set conn = Nothing
		End If
		Response.Write "<Script Language=javascript>alert('请不要在参数中包含非法字符尝试注入');history.back(-1)</Script>"  
		Response.end
		End If
		Next
		Next
	End If
	'cookies请求的注入的拦截  
	If Request.cookies<>"" Then 
		For Each FrSql_Post1 In Request.cookies 
		For FrSql_Xh=0 To Ubound(FrSql_Inf) 
		If Instr(LCase(Request.Form(FrSql_Post1)),FrSql_Inf(FrSql_Xh))<>0 Then
		If WriteSql=True Then
			conn.Execute("insert into job_errlog(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','COOKIES','"&FrSql_Post1&"','"&replace(Request.Form(FrSql_Post1),"'","''")&"')")
			conn.close
			Set conn = Nothing
		End If
		Response.Write "<Script Language=javascript>alert('请不要在参数中包含非法字符尝试注入');history.back(-1)</Script>"  
		Response.end
		End If
		Next 
		Next 
	End If
End If
End Sub

Sub SQLKillip()
If Kill_IP=True Then
	Dim Sqlin_IP,rsKill_IP,Kill_IPsql
	Sqlin_IP=Request.ServerVariables("REMOTE_ADDR")
	Kill_IPsql="select Sqlin_IP from Job_Errlog where Sqlin_IP='"&Sqlin_IP&"' and Sqlin_Killip="&FR_HR_True&""
	Set rsKill_IP=conn.execute(Kill_IPsql)
	If Not(rsKill_IP.eof or rsKill_IP.bof) Then
	Response.write "<Script Language=JavaScript>alert('禁止访问！\n\n你的Ip已经被本系统自动锁定！\n\n如想访问本站请和管理员联系！\n\n联系电话："&ContactPhone&"！');</Script>"
	Response.End
	End If
	rsKill_IP.close
	Set rsKill_IP=Nothing
End If
End Sub
%>