/// <summary>
///SQL注入过滤
/// </summary>
/// <param name="InText">要进行过滤的字符串</param>
/// <returns>如果参数存在不安全字符,则返回true</returns>
public static bool SqlFilter2(string InText)
{
string word = "exec|insert|select|delete|update|chr|mid|master|or|truncate|char|declare|join";
if (InText == null)
return false;
foreach (string i in word.Split('|'))
{
if ((InText.ToLower().IndexOf(i + " ") > -1) || (InText.ToLower().IndexOf(" " + i) > -1))
{
return true;
}
}
return false;
}
/// <summary>
/// 将指定的str串执行sql关键字过滤并返回
/// </summary>
/// <param name="str">要过滤的字符串</param>
/// <returns></returns>
public static string SqlFilter(string str)
{
return str.Replace("'", "").Replace("'", "").Replace("--", "").Replace("&","").Replace("/*","").Replace(";","").Replace("%","");
}
/// <summary>
/// 将指定的串列表执行sql关键字过滤并以[,]号分隔返回
/// </summary>
/// <param name="strs"></param>
/// <returns></returns>
public static string SqlFilters(params string[] strs)
{
StringBuilder sb = new StringBuilder();
foreach (string str in strs)
{
sb.Append(SqlFilter(str) + ",");
}
if (sb.Length > 0)
return sb.ToString().TrimEnd(',');
return "";
}
public static bool ProcessSqlStr(string Str)
{
bool ReturnValue = false;
try
{
if (Str != "")
{
string SqlStr = "'|insert|select*|and'|or'|insertinto|deletefrom|altertable|update|createtable|createview|dropview|createindex|dropindex|createprocedure|dropprocedure|createtrigger|droptrigger|createschema|dropschema|createdomain|alterdomain|dropdomain|);|select@|declare@|print@|char(|select";
string[] anySqlStr = SqlStr.Split('|');
foreach (string ss in anySqlStr)
{
if (Str.IndexOf(ss) >= 0)
{
ReturnValue = true;
}
}
}
}
catch
{
ReturnValue = true;
}
return ReturnValue;
}
原文:https://blog.csdn.net/weixin_38236891/article/details/90205830