mysql恶意代码_mysql数据库恶意代码注入的清理

using System.Data.SqlClient;

public partial class _Default : System.Web.UI.Page

{

protected void Page_Load(object sender, EventArgs e)

{

}

string dataName = "";

string tableName = "";

string datafield = "";

string S_str = "";

string ReS_str = "";

string LogName = "";

string LogPsw = "";

protected void Button1_Click(object sender, EventArgs e)

{

dataName = txtDb.Text.Trim();// 数据库名

tableName = txtTb.Text.Trim();//表名

datafield = txtField.Text.Trim();//列名

S_str = txtTheStr.Text.Trim();//清理的字符串

ReS_str = txtStr.Text.Trim();//被清理的字符串

LogName = txtLogName.Text.Trim();//数据库登录名

LogPsw = txtLogPsw.Text.Trim();//数据库登录密码

//集成验证

//string strcon = @"Data Source=.;Initial Catalog="+dataName+";Integrated Security=True";

string strcon =@"server=localhost;database="+dataName+";UID="+LogName+" ;PassWord="+LogPsw;

SqlConnection con = new SqlConnection();

con.ConnectionString = strcon;

SqlCommand com = con.CreateCommand();

//创建内存表

DataTable myTempTb = new DataTable();

myTempTb.Columns.Add("Id");

myTempTb.Columns.Add("Content");

//

com.CommandText = "select ID,"+datafield+" from "+tableName;

SqlDataReader dr;

con.Open();

try

{

dr = com.ExecuteReader();

//清理数据

string Contentstr = "";

while(dr.Read())

{

string Id = dr[0].ToString();

Contentstr = dr[1].ToString();

Contentstr = Contentstr.Replace(S_str, ReS_str);

//清理后暂时存在内存表中

myTempTb.Rows.Add(new object[] { Id, Contentstr });

}

dr.Close();

dr.Dispose();

con.Close();

con.Dispose();

//回填数据

for (int i = 0; i < myTempTb.Rows.Count; i++)

{

string id ="";

id= myTempTb.Rows[0].ToString();

Contentstr = myTempTb.Rows[1].ToString();

execTheRe(id, Contentstr);

}

Response.Write("");

}

catch (Exception ex)

{

Response.Write("");

}

}

private void execTheRe(string id, string content)

{

try

{

string strcon = @"server=localhost;database=" + dataName + ";UID=" + LogName + " ;PassWord=" + LogPsw;

SqlConnection con = new SqlConnection();

con.ConnectionString = strcon;

SqlCommand com = con.CreateCommand();

con.Open();

com.CommandText = "update " + tableName + " set " + datafield + "=@content where ID=" + id;

SqlParameter myPar;

myPar = new SqlParameter("@content", SqlDbType.Text);

myPar.Value = content;

com.Parameters.Add(myPar);

com.ExecuteNonQuery();

con.Close();

}

catch (Exception ex)

{

Response.Write("");

}

}

}