ASP.NET 防止SQL注入式攻击

using System;

namespace Theme.Services.Public
{
 /// <summary>
 /// SqlstrAny 的摘要说明。
 /// </summary>
 public class ProcessRequest
 {
  public ProcessRequest()
  {
   //
   // TODO: 在此处添加构造函数逻辑
   //
  }

  #region SQL注入式攻击代码分析
  /// <summary>
  /// 处理用户提交的请求
  /// </summary>
  public void StartProcessRequest()
  {
   try
   {
    string getkeys = "";
    string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings["CustomErrorPage"].ToString();
    if (System.Web.HttpContext.Current.Request.QueryString != null)
    {
    
     for(int i=0;i<System.Web.HttpContext.Current.Request.QueryString.Count;i++)
     {
      getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];
      if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys]))
      {
       System.Web.HttpContext.Current.Response.Redirect (sqlErrorPage+"?errmsg=sqlserver&sqlprocess=true");
       System.Web.HttpContext.Current.Response.End();
      }
     }
    }
    if (System.Web.HttpContext.Current.Request.Form != null)
    {
     for(int i=0;i<System.Web.HttpContext.Current.Request.Form.Count;i++)
     {
      getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i];
      if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys]))
      {
       System.Web.HttpContext.Current.Response.Redirect (sqlErrorPage+"?errmsg=sqlserver&sqlprocess=true");
       System.Web.HttpContext.Current.Response.End();
      }
     }
    }
   }
   catch
   {
    // 错误处理: 处理用户提交信息!
   }
  }
  /// <summary>
  /// 分析用户请求是否正常
  /// </summary>
  /// <param name="Str">传入用户提交数据</param>
  /// <returns>返回是否含有SQL注入式攻击代码</returns>
  private bool ProcessSqlStr(string Str)
  {
   bool ReturnValue = true;
   try
   {
    if (Str != "")
    {
     string SqlStr = "and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare ";
     string[] anySqlStr = SqlStr.Split('|');
     foreach (string ss in anySqlStr)
     {
      if (Str.IndexOf(ss)>=0)
      {
       ReturnValue = false;
      }
     }
    }
   }
   catch
   {
    ReturnValue = false;
   }
   return ReturnValue;
  }
  #endregion

 }
}

// System.Configuration.ConfigurationSettings.AppSettings["CustomErrorPage"].ToString(); 这个为用户自定义错误页面提示地址,
//在Web.Config文件时里面添加一个 CustomErrorPage 即可
//<!-- 防止SQL数据库注入攻击的出错页面自定义地址 -->
//    <add key="CustomErrorPage" value="../Error.html" />

Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=677728

OleDbCommand cmd = new OleDbCommand("Select * From urlTable Where regNameDB = @userName",Conn);
cmd.Parameters.Add(new OleDbParameter("@userName",OleDbType.VarChar,50));
cmd.Parameters["@userName"].Value = userName;