招商电话:0351-6060229   传真: 0351-6186559
<% noip1 = Request.ServerVariables("HTTP_X_FORWARDED_FOR") noip2 = Request.ServerVariables("REMOTE_ADDR") '''''''''''''''''''''''''''''''''''''' if noip1 = "" then noip=noip2 else noip=noip1 end if '''''''''''''''''''''''''''''''''' if (noip1="unknown" or noip2="unknown") or (noip1="" and noip2="") then Response.write "系统拒绝了你的来访IP不明访问请求，如有问题请与开发人员联系客服中心联系" Response.end end if '''''''''''''''''''''''''''' 'SQL注入式攻击防范get及ID（not）代码 squery=lcase(Request.ServerVariables("QUERY_STRING")) sURL=lcase(Request.ServerVariables("HTTP_HOST")) 'response.write sURL&"
" allquery=squery+sURL if InStr(allquery,"%20")<>0 or InStr(allquery," ")<>0 or InStr(allquery,"%27")<>0 or InStr(allquery,"'")<>0 or InStr(allquery,"%a1a1")<>0 or InStr(allquery,"　")<>0 or InStr(allquery,"%24")<>0 or InStr(allquery,"$")<>0 or InStr(allquery,"%3b")<>0 or InStr(allquery,";")<>0 or InStr(allquery,":")<>0 or InStr(allquery,"%%")<>0 or InStr(allquery,"%3c")<>0 or InStr(allquery,"<")<>0 or InStr(allquery,">")<>0 or InStr(allquery,"--")<>0 or InStr(allquery,"sp_")<>0 or InStr(allquery,"xp_")<>0 or InStr(allquery,"exec")<>0 or InStr(allquery,"\")<>0 or InStr(allquery,"delete")<>0 or InStr(allquery,"dir")<>0 or InStr(allquery,"exe")<>0 or InStr(allquery,"select")<>0 or InStr(allquery,"Update")<>0 or InStr(allquery,"cmd")<>0 or InStr(allquery,"*")<>0 or InStr(allquery,"^")<>0 or InStr(allquery,"(")<>0 or InStr(allquery,")")<>0 or InStr(allquery,"+")<>0 or InStr(allquery,"copy")<>0 or InStr(allquery,"format")<>0 or not(isnumeric(request("userid"))) or not(isnumeric(request("id"))) or not(isnumeric(request("lbid"))) or not(isnumeric(request("xlbid"))) or not(isnumeric(request("cpid"))) or not(isnumeric(request("cp_id"))) or not(isnumeric(request("page"))) then win=Request.ServerVariables("HTTP_USER_AGENT") 'set rs = conn.execute("select js from nosql where ip='"&noip&"'") ' if not rs.eof then 'conn.execute("Update nosql set js=js+1 where ip='"&noip&"'") '反击开绐(调用了一个死循环) Response.write "" Response.end '反击结束 'else 'conn.execute("Insert into nosql(ip)values('"&noip&"')") Response.Write("") ' Response.End ' end if rs.close end if %>