过滤网址和输入框中的特殊字符，防止sql注入（C#版）

 防sql注入不必在每个页面都写验证了，下面方面便可以一劳永逸。

 

 using System;using System.Data;using System.Configuration;using System.Web;using System.Web.Security;using System.Web.UI;using System.Web.UI.HtmlControls;using System.Web.UI.WebControls;using System.Web.UI.WebControls.WebParts;/// <summary>///cedar 的摘要说明/// </summary>public class cedar:IHttpModule{public cedar(){////TODO: 在此处添加构造函数逻辑//} public void Dispose() { } public void Init(HttpApplication application) { application.AcquireRequestState += new EventHandler(application_AcquireRequestState); } private void application_AcquireRequestState(object sender, EventArgs e) { HttpContext content = ((HttpApplication)sender).Context; try { string sqlErrorPage = "default.html";//转到默认页面 string keyValue = string.Empty; string requestUrl = content.Request.Path.ToString(); if (content.Request.QueryString != null) { foreach (string val in content.Request.QueryString) { keyValue= content.Server.UrlDecode(content.Request.QueryString[val]); if (!processSqlStr(keyValue)) { content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。<br><a href=""+sqlErrorPage+"" mce_href=""+sqlErrorPage+"">转到首页</a>"); content.Response.End(); break; } } } if (content.Request.Form != null) { foreach(string val in content.Request.Form) { keyValue = content.Server.HtmlDecode(content.Request.Form[val]); if (keyValue == "_ViEWSTATE") continue; if (!processSqlStr(keyValue)) { content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。"); content.Response.End(); break; } } } } catch (Exception ex) { } } private bool processSqlStr(string str) { bool returnValue = true; try { if (str.Trim() != "") { //取得webconfig中过滤字符串 string sqlStr = ConfigurationManager.AppSettings["FilterSql"].Trim(); //string sqlStr = "declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate"; string[] sqlStrs = sqlStr.Split('|'); foreach (string ss in sqlStrs) { if (str.ToLower().IndexOf(ss) >= 0) { sqlStr = ss; returnValue = false; break; } } } } catch { returnValue = false; } return returnValue; }}

 

在web.config中添加以下：

<appSettings>
  <add key="FilterSql" value="declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate "/>
 </appSettings>

<httpModules>
   <add type="cedar" name="cedar"/>
  </httpModules>