asp.net 网站防攻击 安全

在<system.web>下添加

<machineKey validation="3DES"/>

禁用脚本调试
<compilation debug="true">

跨站点请求伪造,如果要避免 CSRF 攻击,每个请求都应该包含唯一标识,它是攻击者所无法猜测的参数。
protected override void OnInit(EventArgs e)
 {
      base.OnInit(e);
      if (System.Web.HttpContext.Current.Session != null)
     {
            ViewStateUserKey = Session.SessionID;
      }
  }

防止伪造用户身份

public partial class AdminLogin : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if(!Page.IsPostBack)
            Session.Clear();
    }

}

防SQL注入

 public static bool FilterChar(string oldstr)
        {
            bool flag = true;
            string[] filterstr = {"and ","exec ","insert ","select ","delete ","update ","count(","from ","drop ","asc(","char(","or ","chr(","mid("," master",
            "truncate ","declare ","sitename","net user","xp_cmdshell "," /add","exec master.dbo.xp_cmdshell","net localgroup administrators",
            "%",";","/'","/"","-","@",",","//","!","(",")","[","]","{","}","|"};
            for (int i = 0; i < filterstr.Length; i++)
            {
                if (oldstr.Contains(filterstr[i]))
                {
                    flag = false;
                    break;
                }
            }
            return flag;
        }

©️2020 CSDN 皮肤主题: 大白 设计师: CSDN官方博客 返回首页
实付0元
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、C币套餐、付费专栏及课程。

余额充值