已经在conn.asp中加入防注入：

dim sql_injdata,Sql_Inj,SQL_Get,Sql_DATA
SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|master|truncate|declare|sysobjects"
SQL_inj = split(SQL_Injdata,"|")
If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Lcase(Request.QueryString(SQL_Get)),Sql_Inj(Sql_DATA))>0 Then
Response.Write "<Script Language=JavaScript>alert('非法注入!');history.back(-1)</Script>"
Response.end
end if
next
Next
End If

还是被注入了，请指点！！！

把英文的.和''和""都滤掉 ????

加入POST提交的数据验证，杜绝从表单注入。

楼上的版主,有QQ号吗?我加了好像也不行了...

二楼说的也是不管用的！
我把所有的键盘上字符全给弄掉了都不行！！批量向数据库注入没有商量！

[[it] 本帖最后由 孤独冷雨 于 2008-12-1 16:14 编辑 [/it]]

楼主怎么解决的?我现在就是别人一天黑我一次.我要疯狂了.

我觉得还是验证表单内容比较好

Public Function IsValidStr(ByVal Str)
IsValidStr = False
Str = Trim(Str)
If IsNull(Str) Or Str = "" Then Exit Function
On Error Resume Next
ForbidStr = "and|chr|:|=|%|&|$|#|@|+|-|*|/|\|<|>|;|,|^|]|[|)|(|insert|into|update|delete|fuck|shit|select|"
ForbidStr = ForbidStr & Chr(34) & "|" & Chr(39) & "|" & Chr(9)
ForbidStr = Split(ForbidStr, "|")
For i=0 To UBound(ForbidStr)
If InStr(1,Str, ForbidStr(i),1) > 0 Then IsValidStr = False : Exit Function
Next
IsValidStr = True
End Function

看看这样行不行，把这段代码写在Conn.asp中
<%Sub F_Sql()
    Dim Q_Post,Q_Get,Q_In,Q_Inf,i
    'Q_In = "'|and|exec|insert|select|delete|update|count|*|chr|mid|master|truncate|char|declare"
    Q_In = "'|exec|insert|select|delete|update|*|chr|truncate|declare"
    
    Q_Inf = Split(Q_In , "|")
    
    If Request.Form <> "" Then
        For Each Q_Post In Request.Form
            For i = 0 To Ubound(Q_Inf)
                If InStr(LCase(Request.Form(Q_Post)) , Q_Inf(i)) <> 0 Then
                    Response.Write("请不要在参数中包含非法字符尝试注入")
                    Response.End()
                End If
            Next
        Next
    End If
    
    If Request.QueryString <> "" Then
        For Each Q_Get In Request.QueryString
            For i = 0 To Ubound(Q_Inf)
                If InStr(LCase(Request.QueryString(Q_Get)) , Q_Inf(i)) <> 0 Then
                    Response.Write("请不要在参数中包含非法字符尝试注入")
                    Response.End()
                End If
            Next
        Next
    End If
    
End Sub

F_Sql()
%>

[[it] 本帖最后由 关小彤 于 2008-12-3 09:36 编辑 [/it]]

楼上的.

谢谢，加过了，还是不行！

还有其它的可能吗？