防止sql， htm注入

#region 防止代碼注入
  /// <summary>
  /// 防止HTML代碼注入
  /// </summary>
  /// <param name="NoteContent"></param>
  /// <returns></returns>
  public string ExchangeNote(string NoteContent)
  {
  string afterReContent = "";
  afterReContent = NoteContent.Replace("<", "&lt").Replace(">", "&gt");
  return afterReContent;
  }
  /// <summary>
  /// 防止SQL注入
  /// </summary>
  /// <param name="inputStr">輸入的sql語句</param>
  /// <returns>過濾後的語句</returns>
  public static string No_SqlHack(string inputStr)
  {
  //要過濾掉的關鍵字集合
  string NoSqlHack_AllStr = "|;|and|chr(|exec|insert|select|delete|from|update|mid(|master.|";
  string SqlHackGet = inputStr;
  string[] AllStr = NoSqlHack_AllStr.Split('|');

  //分離關鍵字
  string[] GetStr = SqlHackGet.Split(' ');
  if (SqlHackGet != "")
  {
  for (int j = 0; j < GetStr.Length; j++)
  {
  for (int i = 0; i < AllStr.Length; i++)
  {
  if (GetStr[j].ToLower() == AllStr[i].ToLower())
  {
  GetStr[j] = "";
  break;
  }
  }
  }
  SqlHackGet = "";
  for (int i = 0; i < GetStr.Length; i++)
  {
  SqlHackGet += GetStr[i].ToString() + " ";
  }
  return SqlHackGet.TrimEnd(' ').Replace("'", "_").Replace(",", "_").Replace("<", "&lt").Replace(">", "&gt");
  }
  else
  {
  return "";
  }
  }
  #endregion

转载于:https://www.cnblogs.com/xiachufeng/archive/2010/11/04/1869360.html