using System; using System.Data; using System.Configuration; using System.Linq; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.HtmlControls; using System.Web.UI.WebControls; using System.Web.UI.WebControls.WebParts; using System.Xml.Linq; using System.IO; using System.Text; using System.Web.UI.MobileControls; using System.Collections.Generic; /// <summary> ///SQLFilter 的摘要说明 /// </summary> public static class SQLFilter { #region SQL注入过滤 /// <summary> /// SQL注入过滤 /// </summary> /// <param name="sqlParems">要过滤的参数数组</param> /// <returns>如果参数存在不安全字符,则返回false</returns> // 应用示例 // if(TheManagerUtils.SqlFilter(new string[] { "ss","kk" }, this.Page) == false) // { // //直接跳转到相应的错误页面 // Response.Redirect("WelfarePage.aspx"); // return; // } public static bool SqlFilter(string[] sqlParems, Page p) { StringBuilder parems = new StringBuilder(); #region 有关非法数据的相关维护 //常用的SQL恶意字符屏蔽 string sql = "insert|delete|update|select|exec|script"; try { //获取配置在Web.config中最新的SQL恶意字符屏蔽 sql = System.Configuration.ConfigurationSettings.AppSettings["SQLFilter"].ToString(); } catch (Exception) { //对于配置文件的错误配置,将采用常用的SQL恶意字符屏蔽 sql = "insert|delete|update|select|exec|script"; } #endregion #region sqlParems数组参数的合法校验 foreach (string var in SetAllsqlParems(sqlParems,p)) { foreach (string i in sql.Split('|')) { if (var.IndexOf(i.ToLower()) > -1) { try { using (FileStream file = new FileStream(System.Web.HttpContext.Current.Server.MapPath("~//" + DateTime.Now.ToString("yyyy年MM月dd日") + "非法数据记录.txt"), FileMode.Append)) { StreamWriter sw = new StreamWriter(file); foreach (string value in SetAllsqlParems(sqlParems, p)) { parems.Append(" [" + value + "] "); } //p.RegisterStartupScript("", "<mce:script type="text/javascript"><!-- alert('尊敬的非法用户:"+p.User.Identity.Name+",您的IP:"+p.Request.UserHostAddress+" 进行的非法操作已经记录 !'); // --></mce:script>"); //sw.WriteLine(DateTime.Now.ToString("HH:mm:ss") + " 用户:[" + p.User.Identity.Name + ":" + p.Request.UserHostAddress + "] 原始URL:[" + p.Request.Url + "] 非法字符:[" + var + ":" + i + "] 全部参数:" + parems.ToString()); sw.WriteLine(DateTime.Now.ToString("HH:mm:ss") + " IP:[" + p.Request.UserHostAddress + "] 原始URL:[" + p.Request.Url + "] 非法字符:[" + var + ":" + i + "] 全部参数:" + parems.ToString()); sw.WriteLine(); sw.Close(); file.Close(); } } catch (Exception) { } return false; } } } #endregion return true; } #endregion #region 需要校验的数据集合整理 public static string[] SetAllsqlParems(string[] sqlParems, Page p) { List<string> list = new List<string>(); if (sqlParems != null) { foreach (string var in sqlParems) { if (var == null || var.Equals("")) {} else { list.Add(var.Trim().ToLower()); } } } foreach (Control var in p.Form.Controls) { if (var.GetType() == typeof(System.Web.UI.WebControls.TextBox)) { string text = ((System.Web.UI.WebControls.TextBox)var).Text.Trim().ToLower(); if (text == null || text.Equals("")) {} else { list.Add(text); } } } return list.ToArray(); } #endregion }