网站注入与防范的方法总结

1.首先我会检查一下服务器配置，重新配置一次服务器安全，可以参考
http://hi.baidu.com/zzxap/blog/item/18180000ff921516738b6564.html

2.其次，用麦咖啡自定义策略，即使网站程序有漏洞，别人也很难在文件上写入代码了。
参考自定义策略，有了这个策略，再烂的程序，你也无法写入我的文件
http://hi.baidu.com/zzxap/blog/item/efe093a7e0f2c190d04358ef.html

3.可以用网络超级巡警删除被注入的JS代码。
参考
http://hi.baidu.com/anlish/blog/item/ba45bb18eac77e0534fa4134.html

4.如何批量删除数据库中被注入的代码？
在数据库查询分析器运行这段代码即可

SQL code

  

   <!--

Code highlighting produced by Actipro CodeHighlighter (freeware)
http://www.CodeHighlighter.com/

-->
    
   DECLARE
    
   @fieldtype
    sysname 
   SET
    
   @fieldtype
   =
   '
   varchar
   '
    
   --
   删除处理
    
   DECLARE
    hCForEach 
   CURSOR
    GLOBAL 
   FOR
    
   SELECT
    N
   '
   update 
   '
   +
   QUOTENAME
   (o.name) 
   +
   N
   '
    set 
   '
   +
    
   QUOTENAME
   (c.name) 
   +
    N
   '
    = replace(
   '
    
   +
    
   QUOTENAME
   (c.name) 
   +
    
   '
   ,
   ''
   <script_src=http://ucmal.com/0.js> </script>
   ''
   ,
   ''''
   )
   '
    
   FROM
    sysobjects o,syscolumns c,systypes t 
   WHERE
    o.id
   =
   c.id 
   AND
    
   OBJECTPROPERTY
   (o.id,N
   '
   IsUserTable
   '
   )
   =
   1
    
   AND
    c.xusertype
   =
   t.xusertype 
   AND
    t.name
   =
   @fieldtype
    
   EXEC
    sp_MSforeach_Worker 
   @command1
   =
   N
   '
   ?
   '
    

  

5.创建一个触发器，只要有 </script>就不给插入，对性能会有点影响

SQL code

  

   <!--

Code highlighting produced by Actipro CodeHighlighter (freeware)
http://www.CodeHighlighter.com/

-->
    
   create
    
   trigger
    tr_table_insertupdate 
   on
    tablename 
   for
    
   insert
   ,
   update
    
   as
    
   if
    
   exists
    ( 
   select
    
   1
    
   from
    inserted 
   where
    data 
   like
    
   '
   %</script>%
   '
    ) 
   begin
    
   RAISERROR
    (
   '
   不能修改或者添加
   '
   ,
   16
   ,
   1
   ); 
   ROLLBACK
    
   TRANSACTION
    
   end
    
   go
    

  

6.最重要的还是程序的写法，用参数化SQL或存储过程
例如

C# code

  

   <!--

Code highlighting produced by Actipro CodeHighlighter (freeware)
http://www.CodeHighlighter.com/

-->
    
   protected
    
   void
    cmdok_Click(
   object
    sender, EventArgs e) { 
   //
   添加信息
    
    StringBuilder sql 
   =
    
   new
    StringBuilder( 
   "
    insert into m_phone ( pid,PhoneName,num,price,phonetype,onSellTime,color,weight,Video,Camera,phoneSize,phoneSystem,Memorysize,PhoneDesc,Standbytime,ScreenSize,Frequency,InputMethod,Soundrecord,gps,fm,mp3,email,Infrared,game,clock,Calendar,Calculator,Bluetooth) 
   "
   ); sql.Append(
   "
    values (@pid,@TextPhoneName,@Textnum,@Textprice,@Dropphonetype2,@TextonSellTime,@Textcolor,@Textweight 
   "
   ); ................. SqlParameter[] paras 
   =
    { 
   new
    SqlParameter(
   "
   @pid
   "
   , SqlDbType.Int, 
   4
   ) , 
   new
    SqlParameter(
   "
   @TextPhoneName
   "
   , SqlDbType.NVarChar, 
   50
   ) , 
   new
    SqlParameter(
   "
   @Textnum
   "
   , SqlDbType.Int, 
   4
   ) , 
   new
    SqlParameter(
   "
   @Textprice
   "
   , SqlDbType.Int, 
   4
   ) , 
   new
    SqlParameter(
   "
   @Dropphonetype2
   "
   , SqlDbType.VarChar, 
   20
   ) , 
   new
    SqlParameter(
   "
   @TextonSellTime
   "
   , SqlDbType.DateTime, 
   8
   ) , 
   new
    SqlParameter(
   "
   @Textcolor
   "
   , SqlDbType.VarChar, 
   20
   ) , 
   new
    SqlParameter(
   "
   @Textweight
   "
   , SqlDbType.NVarChar, 
   50
   ) , ........... }; 
   string
   [] stra 
   =
    {Dropphonetype.SelectedValue,TextPhoneName.Text , Textnum.Text, Textprice.Text, Dropphonetype2.SelectedValue, TextonSellTime.Text, Textcolor.Text, Textweight.Text, .............}; 
   int
    a
   =
   stra.Length; 
   int
    j; 
   for
    ( j 
   =
    
   0
   ; j 
   <
    a; j
   ++
   ) { paras[j].Value 
   =
    stra[j]; } 
   int
    strpid 
   =
    
   0
   ; 
   string
    sqla 
   =
    sql.ToString(); 
   try
    { SqlHelper.ExcuteNonQurey(sqla, CommandType.Text, paras);
   //
   执行添加数据
    
    strpid 
   =
    Convert.ToInt32(SqlHelper.ExcuteSclare(sqla, CommandType.Text, paras)); 
   //
   获取刚才插入的id号
    
    } 
   catch
    (SqlException ex) { cmdreturn.Text 
   =
    ex.Message.ToString(); } cmdreturn.Text 
   =
    strpid.ToString(); 。。。。。。。。。 

  

7.通过URL传递的参数要用加密解密

C# code

  

   <!--

Code highlighting produced by Actipro CodeHighlighter (freeware)
http://www.CodeHighlighter.com/

-->
    传输 
   string
    szTmp 
   =
    
   "
   safdsfdsafdsfytrsd
   "
   ; szTmp 
   =
    Server.UrlEncode(szTmp); 接收 STRING STRA
   =
   Server.UrlDecode(request.querystring(szTmp)); 

  

8.把要使用的参数处理一下单引号，再放到SQL里面 
  例如 string stra=aa.replace("'","''")

  用参数化SQL可以不用处理单引号
  指定参数类型和过滤掉单引号，就可以杜绝99.9%入侵了


另外说一句：网上那些被人奉如圣经的过滤 update insert  等关键字的程序是用处不大的  upupdatedate 过滤掉 update还是update
还会造成不必要的麻烦