sql injection 방지 (GET 방식)

좋은 자료가 있어 기록 남김... 

<%

'### sql injection 방지 (GET 방식)

'### 등록안한 특수문자 (;, @, :, +)

'### exec, sp_, xp_, decrare 는 바로 차단.

'### 폼에서 넘어오는 값들은 폼받는 곳에서 처리해 줘야함.

Sub Check_SQL()

Dim LWItem, strlogfilename, HLogfso, FormData, ErrParity, HLogGetFile, errURL

'## 로그파일 위치 (권한 줘야함)

strlogfilename = server.mappath("\") & "\files\ReqData.txt"

For each LWItem in Request.QueryString

'response.write (LWItem & ":" & Request.QueryString(LWItem) & "<BR>")

if Request(LWItem) <> empty then

'## 명령함수

if inStr(lcase(Request(LWItem)), "exec") > 0 Or inStr(lcase(Request(LWItem)), "declare") > 0 Or inStr(lcase(Request(LWItem)), "sp_") > 0 Or inStr(lcase(Request(LWItem)), "xp_") > 0 Or inStr(lcase(Request(LWItem)), "0x") > 0 then

ErrParity = 10

Exit for

end If

'## 특수문자

if inStr(lcase(Request(LWItem)), "'") > 0 Or inStr(lcase(Request(LWItem)), "--") > 0 then

ErrParity = 11

exit for

end if

'## select, delete 방지

if (inStr(lcase(Request(LWItem)), "select") > 0 or inStr(lcase(Request(LWItem)), "delete") > 0) and inStr(lcase(Request(LWItem)), "from") > 0 then

ErrParity = 30

exit for

end if

'## update 방지

if inStr(lcase(Request(LWItem)), "update") > 0 and inStr(lcase(Request(LWItem)), "set") > 0 then

ErrParity = 31

exit for

end if

'## insert 방지

if inStr(lcase(Request(LWItem)), "insert") > 0 and inStr(lcase(Request(LWItem)), "into") > 0 then

ErrParity = 32

exit for

end if

end if

Next

' 폼쪽은 폼 넘어가는 곳에서 처리 해야함.

' For each LWItem in Request.Form

' 'response.write (LWItem & ":" & Reuqest.QueryString(LWItem) & "<BR>")

' FormData = FormData & "&" & lwItem & "=" & Request(LWItem)

'

' if Request(LWItem) <> empty then

' '## 명령함수

' if inStr(lcase(Request(LWItem)), "exec") > 0 or inStr(lcase(Request(LWItem)), "declare") > 0 Or inStr(lcase(Request(LWItem)), "sp_") > 0 or inStr(lcase(Request(LWItem)), "xp_") > 0 or inStr(lcase(Request(LWItem)), "0x") > 0 then

' ErrParity = 20

' Exit for

' end if

'

' '## 특수문자

' if inStr(lcase(Request(LWItem)), "'") > 0 Or inStr(lcase(Request(LWItem)), "--") > 0 then

' ErrParity = 21

' exit for

' end if

'

' '## select, delete 방지

' if (inStr(lcase(Request(LWItem)), "select") > 0 or inStr(lcase(Request(LWItem)), "delete") > 0) and inStr(lcase(Request(LWItem)), "from") > 0 then

' ErrParity = 40

' exit for

' end if

'

' '## update 방지

' if inStr(lcase(Request(LWItem)), "update") > 0 and inStr(lcase(Request(LWItem)), "set") > 0 then

' ErrParity = 41

' exit for

' end if

'

' '## insert 방지

' if inStr(lcase(Request(LWItem)), "insert") > 0 and inStr(lcase(Request(LWItem)), "into") > 0 then

' ErrParity = 42

' exit for

' end if

' end if

' Next

'response.write "<BR>"&errparity

if ErrParity >= 1 then

Set HLogfso = Server.CreateObject("Scripting.FileSystemObject")

if HLogfso.fileexists(strlogfilename) Then

set HLoggetfile = HLogfso.opentextfile(strlogfilename, 8, true)

Else

set HLoggetfile = HLogfso.createtextfile(strlogfilename, true)

end if

HLoggetfile.writeline "[" &ErrParity& "]" & now() & " " & Request.Servervariables("REMOTE_ADDR")

HLoggetfile.writeline "URL:" & Request.Servervariables("URL")

HLoggetfile.writeline "Cookie:" & request.ServerVariables("HTTP_COOKIE")

if FormData = empty then

HLoggetfile.writeline "Query:" & request.ServerVariables("QUERY_STRING") & vbCRLF

else

HLoggetfile.writeline "Form:" & FormData & vbCRLF

end if

HLoggetfile.close

end if

'## 에러시 접근 허용 안함.

if ErrParity >= 1 Then

'## 리턴페이지

errURL = "/"

%>

<script language="javascript">

alert("오류(<%=ErrParity%>).시스템 관리자에게 문의하세요.");

document.location = "<%=errURL%>";

</script>

<%

response.End()

end if

end sub

call Check_SQL()

%>