防止JS注入

再在Global文件里里加入
   protected void Application_BeginRequest(Object sender, EventArgs e)
   {
   //SQL防注入
   string Sql_1 = "exec|insert+|select+|delete+|update+|count|chr|mid|master+|truncate|char|declare|drop+|drop+table|creat+|creat+table";
   string Sql_2 = "exec+|insert|insert+|delete+|update+|count(|count+|chr+|+mid(|+mid+|+master+|truncate+|char+|+char(|declare+|drop+|creat+|drop+table|creat+table";
   string[] sql_c = Sql_1.Split('|');
   string[] sql_c1 = Sql_2.Split('|');

   if (Request.QueryString != null)
   {
   foreach (string sl in sql_c)
   {
   if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= 0)
   {
   Response.Write("警告！你的IP已经被记录!不要使用敏感字符！");//
   Response.Write(sl);
   Response.Write(Request.QueryString.ToString());
   Response.End();
   break;
   }
   }
   }

   if (Request.Form.Count > 0)
   {
   string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称
   if (Request.ServerVariables["HTTP_REFERER"] != null)
   {
   string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称
   string s3 = "";
   if (s1.Length > (s2.Length - 7))
   {
   s3 = s2.Substring(7);
   }
   else
   {
   s3 = s2.Substring(7, s1.Length);
   }
   if (s3 != s1)
   {
   Response.Write("警告！你的IP已经被记录!不要使用敏感字符！");//
   Response.End();
   }
   }
   }
   }

  b.对参数进行SQL防止注入判断
   public static string SafeSqlLiteral(string inputSQL)
   {
    // check incoming parameters for null or blank string
    if ((inputString != null) && (inputString != String.Empty))
    {
    inputString = inputString.Trim();

                  inputString = Regex.Replace(inputString, "[//s]{2,}", " "); //two or more spaces
                  inputString = Regex.Replace(inputString, "(<[b|B][r|R]/*>)+|(<[p|P](.|//n)*?>)", "/n"); //<br>
                  inputString = Regex.Replace(inputString, "(//s*&[n|N][b|B][s|S][p|P];//s*)+", " "); //&nbsp;
                  inputString = Regex.Replace(inputString, "<(.|//n)*?>", string.Empty); //any other tags
                  inputString = inputString.Replace("'", "''");

                  return inputString;
   }
   else
    return inputString;
   }

  c.彻底杜绝SQL注入

   1.不要使用sa用户连接数据库
   2、新建一个public权限数据库用户，并用这个用户访问数据库
   3、[角色]去掉角色public对sysobjects与syscolumns对象的select访问权限
   4、[用户]用户名称-> 右键－属性－权限－在sysobjects与syscolumns上面打“×”
   5、通过以下代码检测（失败表示权限正确，如能显示出来则表明权限太高）：
   DECLARE @T varchar(255),
   @C varchar(255)
   DECLARE Table_Cursor CURSOR FOR
   Select a.name,b.name from sysobjects a,syscolumns b
   where a.id=b.id and a.xtype= 'u ' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)
   OPEN Table_Cursor
   FETCH NEXT FROM Table_Cursor INTO @T,@C
   WHILE(@@FETCH_STATUS=0)
   BEGIN print @c
   FETCH NEXT FROM Table_Cursor INTO @T,@C
   END
   CLOSE Table_Cursor
   DEALLOCATE Table_Cursor

   sql2005做法：
   1、在系统视图找到sysobjects a,syscolumns b ，属性，进入权限，找到SELECT后面拒绝打勾即可。