using System;
using System.Data;
using System.Configuration;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
using System.IO;
using System.Text;
using System.Web.UI.MobileControls;
using System.Collections.Generic;
/// <summary>
///SQLFilter 的摘要说明
/// </summary>
public static class SQLFilter
{
#region SQL注入过滤
/// <summary>
/// SQL注入过滤
/// </summary>
/// <param name="sqlParems">要过滤的参数数组</param>
/// <returns>如果参数存在不安全字符,则返回false</returns>
public static bool SqlFilter(string[] sqlParems, Page p)
{
StringBuilder parems = new StringBuilder();
//常用的SQL恶意字符屏蔽
string sql = "insert|delete|update|select|exec|script";
try
{
//获取配置在Web.config中最新的SQL恶意字符屏蔽
sql = System.Configuration.ConfigurationSettings.AppSettings["SQLFilter"].ToString();
}
catch (Exception)
{
//对于配置文件的错误配置,将采用常用的SQL恶意字符屏蔽
sql = "insert|delete|update|select|exec|script";
}
foreach (string var in SetAllsqlParems(sqlParems,p))
{
foreach (string i in sql.Split('|'))
{
if (var.IndexOf(i.ToLower()) > -1)
{
try
{
//创建非法记录日志
using (FileStream file = new FileStream(System.Web.HttpContext.Current.Server.MapPath("~\\" + DateTime.Now.ToString("yyyy年MM月dd日") + "非法数据记录.txt"), FileMode.Append))
{
StreamWriter sw = new StreamWriter(file);
foreach (string value in SetAllsqlParems(sqlParems, p))
{
parems.Append(" [" + value + "] ");
}
sw.WriteLine(DateTime.Now.ToString("HH:mm:ss") + " IP:[" + p.Request.UserHostAddress + "] 原始URL:[" + p.Request.Url + "] 非法字符:[" + var + ":" + i + "] 全部参数:" + parems.ToString());
sw.WriteLine();
sw.Close();
file.Close();
}
}
catch (Exception) { }
return false;
}
}
}
return true;
}
#endregion
#region 需要校验的数据集合整理
public static string[] SetAllsqlParems(string[] sqlParems, Page p)
{
List<string> list = new List<string>();
if (sqlParems != null)
{
foreach (string var in sqlParems)
{
if (var == null || var.Equals(""))
{}
else
{
list.Add(var.Trim().ToLower());
}
}
}
foreach (Control var in p.Form.Controls)
{
if (var.GetType() == typeof(System.Web.UI.WebControls.TextBox))
{
string text = ((System.Web.UI.WebControls.TextBox)var).Text.Trim().ToLower();
if (text == null || text.Equals(""))
{}
else
{
list.Add(text);
}
}
}
return list.ToArray();
}
#endregion
}
// 应用示例
// if(TheManagerUtils.SqlFilter(new string[] { "userName","pass;delete" }, this.Page) == false)
// {
// //直接跳转到相应的错误页面
// Response.Redirect("WelfarePage.aspx");
// return;
// }
// if(TheManagerUtils.SqlFilter(null, this.Page) == false)
// {
// //直接跳转到相应的错误页面
// Response.Redirect("WelfarePage.aspx");
// return;
// }