[ASP] SQL injection 방지 - 변수 필터링 추가 작업

 

 

Input_Type = ReForm2(theform.item("Input_Type"),0,0)
url = ReForm2(theform.item("url"),0,0)

 

<%
'SQL injection방지
Function ReForm2(sString , nMaxLen , isNum )
'// Request 로 들어온 변수를 처리한다.
'// sString : 넘겨받는 변수 (string)
'// nMaxLen : 최대 길이 (number)  (최대길이를 검사하지 않은경우 0)
'// isNum  : 숫자인지 아닌지 (1 : only number , 0 : 숫자판별 안함)
' param1 = ReForm2(request.Form("param1"),0,0)
 
    Dim temp
    Dim nErr
    temp = Trim(sString ) & ""
 
    if isNum = 1 then    '숫자판별
        if isNumeric(temp) = False then
            response.write( temp & " is Not Number " )
            response.End
        End if
    end if
 
 
    if nMaxLen > 0 then    '최대길이 판별
        if len(temp) > nMaxLen then
            response.write( temp & " is over Maxlength " & nMaxLen  )
            response.end
        end if
    end if
 
 
 
    '// injection 관련 키워드 제거(항목 추가 가능)
    temp = Replace( temp , "'" , "" )
    temp = Replace( temp , "--" , "" )
    temp = Replace( temp , "--, #" , " " )
    temp = Replace( temp , "/* */" , " " )
    temp = Replace( temp , "' or 1=1--" , " " )
    temp = Replace( temp , "union" , " " )
    temp = Replace( temp , "select" , " " )
    temp = Replace( temp , "delete" , " " )
    temp = Replace( temp , "insert" , " " )
    temp = Replace( temp , "update" , " " )
    temp = Replace( temp , "drop" , " " )
    temp = Replace( temp , "on error resume" , " " )
    temp = Replace( temp , "execute" , " " )
    temp = Replace( temp , "windows" , " " )
    temp = Replace( temp , "boot" , " " )
    temp = Replace( temp , "-1 or" , " " )
    temp = Replace( temp , "-1' or" , " " )
    temp = Replace( temp , "../" , " " )
    temp = Replace( temp , "unexisting" , " " )
    temp = Replace( temp , "win.ini" , " " )
    
    ReForm2 = temp
 
End Function
 
%>

 

 

참고 : https://l2j.co.kr/2844