把你后台地址设复杂点！密码最好用字母加数字，然后再进行加密！
再就像2楼所说那样，在CONN里加防注入。然后再用软件测试一下。这一套下来如果没有问题的话，应该就好多了！
给你一个我常用的
conn.asp
<!--#include file="sql.asp"-->
<%
call CheckSql()
set conn=server.CreateObject("adodb.connection")
connstr="provider=microsoft.jet.oledb.4.0;data source=" & server.MapPath("new/db/sxzx-net.asp")
conn.open connstr
%>
sql.asp
<%
Function CheckSql() '防止SQL注入
Dim sql_injdata
SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|=|_|‘|~"
SQL_inj = split(SQL_Injdata,"|")
If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then
Response.Write "<Script Language='javascript'>{alert('请不要在参数中包含非法字符！');}</Script>"
Response.Write "本站有服务不到位的地方,请多提建议!如果你糊来小心我掐死你↓<br><br>"
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br><br>"
Response.Write "操作时间："&Now&"<br><br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br><br>"
Response.Write "提交方式：Get<br><br>"
Response.Write "提交参数："&SQL_Get&"<br><br>"
Response.Write "提交数据："&Request.QueryString(SQL_Get)
response.Write "<meta http-equiv='refresh' content='3;url=/'>"
Response.end
end if
next
Next
End If
'**************************************************
If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then
Response.Write "<Script Language='javascript'>alert('请不要在参数中包含非法字符！');</Script>"
Response.Write "本站有服务不到位的地方,请多提建议!如果你糊来小心我掐死你↓<br><br>"
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br><br>"
Response.Write "操作时间："&Now&"<br><br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br><br>"
Response.Write "提交方式：Post<br><br>"
Response.Write "提交参数："&SQL_Get&"<br><br>"
Response.Write "提交数据："&Request.Form(SQL_post)
response.Write "<meta http-equiv='refresh' content='3;url=/'>"
Response.end
end if
next
next
end if
End Function
%>
[
本帖最后由 孤独冷雨 于 2009-8-12 15:58 编辑 ]
