php mvc 防注入,Asp.net MVC 简单实现防 xss攻击,sql注入攻击

Asp.net MVC 简单实现防 xss攻击,sql注入攻击

新建过滤帮助类

using System;

using System.Web;

using System.Text;

using System.Text.RegularExpressions;

public class safe_360

{

private const string StrRegex = @"]+?style=[\w]+?:expression\(|\b(alert|confirm|prompt)\b|^\+/v(8|9)|]*?=[^>]*?[^>]*?>|\b(and|or)\b.{1,6}?(=|>|

public static bool PostData()

{

bool result = false;

for (int i = 0; i < HttpContext.Current.Request.Form.Count; i++)

{

result = CheckData(HttpContext.Current.Request.Form[i].ToString());

if (result)

{

break;

}

}

return result;

}

public static bool GetData()

{

bool result = false;

for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++)

{

result = CheckData(HttpContext.Current.Request.QueryString[i].ToString());

if (result)

{

break;

}

}

return result;

}

public static bool CookieData()

{

bool result = false;

for (int i = 0; i < HttpContext.Current.Request.Cookies.Count; i++)

{

result = CheckData(HttpContext.Current.Request.Cookies[i].Value.ToLower());

if (result)

{

break;

}

}

return result;

}

public static bool referer()

{

bool result = false;

return result = CheckData(HttpContext.Current.Request.UrlReferrer.ToString());

}

public static bool CheckData(string inputData)

{

if (Regex.IsMatch(inputData, StrRegex))

{

return true;

}

else

{

return false;

}

}

}

在Global.asax文件中添加Application_BeginRequest事件

void Application_BeginRequest(object sender, EventArgs e)

{

if (Request.Cookies != null)

{

if (safe_360.CookieData())

{

Response.Write("您提交的Cookie数据有恶意字符！");

Response.End();

}

}

if (Request.UrlReferrer != null)

{

if (safe_360.referer())

{

Response.Write("您提交的Referrer数据有恶意字符！");

Response.End();

}

}

if (Request.RequestType.ToUpper() == "POST")

{

if (safe_360.PostData())

{

Response.Write("您提交的Post数据有恶意字符！");

Response.End();

}

}

if (Request.RequestType.ToUpper() == "GET")

{

if (safe_360.GetData())

{

Response.Write("您提交的Get数据有恶意字符！");

Response.End();

}

}

}