Soke

ASP에서 SQL 인젝션(Injection) 방어하기

' Array, Replace를 이용한 방법

Function SQLInject(strWords)

Dim BadChars, newChars

BadChars = Array ("--", ";", "/*", "*/", "@@", "@",_

                  "char", "nchar", "varchar", "nvarchar",_

                  "alter", "begin", "cast", "create", "cursor",_

                  "declare", "delete", "drop", "end", "exec",_

                  "execute", "fetch", "insert", "kill", "open",_

                  "select", "sys", "sysobjects", "syscolumns",_

                  "table", "update", "xp_")

newChars = strWords

For i = 0 To UBound(BadChars)

newChars = Replace(newChars, BadChars(i), "")

Next

newChars = Replace(newChars, "'", "''")

newChars = Replace(newChars, " ", "")

newChars = Replace(newChars, "|", "''")

newChars = Replace(newChars, "\""", "|")

newChars = Replace(newChars, "|", "''")

SQLInject = newChars

End Function

' 정규식 객체를 이용한 방법

Function SQLInJect2(strWords)

Dim BadChars, newChars, tmpChars, regEx, i

BadChars = Array( _

"select(.*)(from|with|by){1}", _

"insert(.*)(into|values){1}", _

"update(.*)set", _

"delete(.*)(frm|with){1}", _

"drop(.*)(from|aggre|role|assem|key|cert|cont|credential|data|endpoint|event|fulltext|function|index|login|type|schema|procedure|que|remote|role|route|sign|stat|syno|table|trigger|user|view|xml){1}", _

"alert(.*)(application|assem|key|author|cert|credential|data|endpoint|fulltext|function|index|login|type|schema|procedure|que|remote|role|route|serv|table|user|view|xml){1}", _

"xp_", "sp_", "restore\s", "grant\s", "revoke\s", "dbcc", "dump", "use\s", "set\s", "truncate\s", "backup\s", "load\s", "save\s", "shutdown", _

"cast(.*)\(", "convert(.*)\(", "execute\s", "updatetext", "writetext", "reconfigure", _

"/\*", "\*/", ";", "\-\-", "\[", "\]", "char(.*)\(", "nchar(.*)\("  )

newChars = strWords

For i = 0 To UBound(BadChars)

Set regEx = New RegExp ' 정규식 객체의 인스턴스 생성

regEx.Pattern = BadChars(i)

regEx.IgnoreCase = True

regEx.Global = True

newChars = regEx.Replace(newChars,"")

Set regEx = Nothing

Next

newChars = Replace(newChARS, "'", "''")

SQLInject2 = newChars

End Function