求一或若干Sql防注入函数
RT
[解决办法]
public static bool checkstring(string str) //危险码过滤
{
string str2 = str;
if (str == "" || str == null)
{ return false; }
else
{
str = str.ToLower();
str = str.Replace("'", "");
str = str.Replace("-", "");
str = str.Replace("<", "");
str = str.Replace(">", "");
str = str.Replace("and", "");
str = str.Replace("or", "");
str = str.Replace("=", "");
str = str.Replace("%", "");
str = str.Replace("*", "");
str = str.Replace("?", "");
str = str.Replace("#", "");
str = str.Replace("~", "");
str = str.Replace("&", "");
str = str.Replace("^", "");
}
if (str.Length == str2.Length)
{ return true; }
else { return false; }
}
然后再输入框那直接调用函数即可
if (ConBLL.checkstring(A_usernmae.Text) && ConBLL.checkstring(A_password1.Text)&&ConBLL.checkstring(A_password2.Text))//限制注入乱码
{
hskfhsadfsffsfsafsadfsdafsadfsdf
}
[解决办法]
#region 安全检测
/// <summary>
/// SQL防注入(URL参数方式)
/// select|update|insert|delete|declare|@|exec|dbcc|alter|drop|create|backup|if|else|end|and|or|add|set|open|close|use|begin|retun|as|go|exists
/// </summary>
public static void chkSql(string str, int Tips_mode, string ErrUrl)
{
string str_t = string.Empty;
if (Tips_mode.ToString() == "")
{
Tips_mode = 1; //处理方式：1=提示信息,2=转向页面,3=先提示再转向
}
if (ErrUrl == "")
{
ErrUrl = "Default.Aspx"; //出错时转向的页面
}
if (str == "")
{
str = System.Web.HttpContext.Current.Request.ServerVariables["QUERY_STRING"];
}
str_t = str.ToLower();
if (str_t.IndexOf("'") >= 0
|| str_t.IndexOf(" or ") >= 0
|| str_t.IndexOf(" and ") >= 0
|| str_t.IndexOf("exec") >= 0
|| str_t.IndexOf("select") >= 0
|| str_t.IndexOf("update") >= 0
|| str_t.IndexOf("chr") >= 0
|| str_t.IndexOf("delete") >= 0
|| str_t.IndexOf(";") >= 0
|| str_t.IndexOf("insert") >= 0
|| str_t.IndexOf("count") >= 0
|| str_t.IndexOf("drop") >= 0
|| str_t.IndexOf("and") >= 0
|| str_t.IndexOf("truncate") >= 0
|| str_t.IndexOf("shell") >= 0
|| str_t.IndexOf("declare") >= 0
|| str_t.IndexOf("@") >= 0
|| str_t.IndexOf("declare") >= 0
|| str_t.IndexOf("dbcc") >= 0
|| str_t.IndexOf("alter") >= 0
|| str_t.IndexOf("create") >= 0
|| str_t.IndexOf("backup") >= 0
|| str_t.IndexOf("if") >= 0
|| str_t.IndexOf("else") >= 0
|| str_t.IndexOf(" add ") >= 0
|| str_t.IndexOf(" open ") >= 0
|| str_t.IndexOf(" close ") >= 0
|| str_t.IndexOf("begin") >= 0
|| str_t.IndexOf("retun") >= 0
|| str_t.IndexOf("exists") >= 0
|| str_t.IndexOf("go ") >= 0
|| str_t.IndexOf("as ") >= 0
)
{
switch (Tips_mode)
{
case 1:
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('出现错误！参数中包含非法字符串！');</script>");
System.Web.HttpContext.Current.Response.End();
break;
case 2:
System.Web.HttpContext.Current.Response.Write("<Script Language=JavaScript>location.href='" + ErrUrl + "'</Script>");
System.Web.HttpContext.Current.Response.End();
break;
case 3:
System.Web.HttpContext.Current.Response.Write("<Script Language=JavaScript>alert('出现错误！参数中包含非法字符串！');ocation.href='" + ErrUrl + "';</Script>");
System.Web.HttpContext.Current.Response.End();
break;
}
}
}
/// <summary>
/// 表单内容提交检查非法字符
/// </summary>
public static string chkSubmitData(string values)
{
if (values.Trim() != "")
{
values = values.Replace("'", "＇").Replace("&", "＆").Replace("%20", "").Replace("－－", "").Replace("＝＝", "").Replace("＜", "").Replace("＞", "").Replace("%", "％").Replace("script", "").Replace("/script", "");
}
return values;
}
#endregion
[解决办法]
1.使用存储过程
2.private static string HTMLEncode(string fString)
{
if (fString != string.Empty)
{
//替换尖括号
fString.Replace("<", "<");
fString.Replace(">", "&rt");
//替换引号
fString.Replace(((char)34).ToString(), """);
fString.Replace(((char)39).ToString(), "'");
//替换空格
fString.Replace(((char)13).ToString(), "");
//替换换行符
fString.Replace(((char)10).ToString(), "<BR> ");
}
return (fString);
}
[解决办法]
使用存储过程过滤非法字符
