asp.net防止sql注入

最新推荐文章于 2020-07-02 16:51:38 发布

5203pw

最新推荐文章于 2020-07-02 16:51:38 发布

阅读量586

点赞数

分类专栏：网站安全 ASP.NET 文章标签： asp.net sql string 代码分析 insert application

本文链接：https://blog.csdn.net/ilovejobs/article/details/5412341

版权

ASP.NET 同时被 2 个专栏收录

5 篇文章 0 订阅

订阅专栏

网站安全

0 篇文章 0 订阅

订阅专栏

asp.net防止sql注入

void Application_BeginRequest(Object sender, EventArgs e)
{
StartProcessRequest();

}

    #region SQL注入式攻击代码分析
    /// <summary>
    /// 处理用户提交的请求
    /// </summary>
    private void StartProcessRequest()
    {
        try
        {
            string str = string.Empty;
            string getkeys = "";
            string sqlErrorPage = "../ErrorPage.aspx";//转向的错误提示页面
            if (System.Web.HttpContext.Current.Request.QueryString != null)
            {

                for (int i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++)
                {
                    getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];
                    if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys]))
                    {

                        System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage );
                        System.Web.HttpContext.Current.Response.End();
                    }
                }
            }
            if (System.Web.HttpContext.Current.Request.Form != null)
            {
                for (int i = 0; i < System.Web.HttpContext.Current.Request.Form.Count; i++)
                {
                    getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i];
                    if (getkeys == "__VIEWSTATE" || getkeys == "hidStdName") continue;
                    if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys]))
                    {

                        System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage);
                        System.Web.HttpContext.Current.Response.End();
                    }
                }
            }
        }
        catch
        {
            // 错误处理: 处理用户提交信息!
        }
    }
    /// <summary>
    /// 分析用户请求是否正常
    /// </summary>
    /// <param name="Str">传入用户提交数据 </param>
    /// <returns>返回是否含有SQL注入式攻击代码 </returns>
    private bool ProcessSqlStr(string Str)
    {

        bool ReturnValue = true;
        try
        {
            if (Str.Trim() != "")
            {
                string SqlStr = "and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare |'|--|drop table|truncate|creat table";

                string[] anySqlStr = SqlStr.Split('|');
                foreach (string ss in anySqlStr)
                {
                    if (Str.ToLower().IndexOf(ss) >= 0)
                    {
                        string strcon = System.Configuration.ConfigurationSettings.AppSettings["adoConstr"].ToString();
                        System.Data.SqlClient.SqlConnection conn = new System.Data.SqlClient.SqlConnection(strcon);
                        conn.Open();
                        System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand("insert into n_errorstd(stdid,type)values('" + ss + "','5')", conn);
                        cmd.ExecuteNonQuery();

                        ReturnValue = false;
                        break;
                    }
                }
            }
        }
        catch
        {
            ReturnValue = false;
        }
        return ReturnValue;
    }
    #endregion