常用网站防止注入方法

1.创建触发器，只要有</script>就不给插入，对性能会有点影响

create trigger tr_table_insertupdate
on tablename
for insert,update
as
if exists (
select 1 from inserted
where data like '%</script>%'
)
begin

 

2.使用参数化的SQL和存储过程

代码

protected   void  cmdok_Click( object  sender, EventArgs e)
    {
         // 添加信息
        StringBuilder  sql  =   new  StringBuilder(  "  insert into m_phone ( pid,PhoneName,num,price,phonetype,onSellTime,color,weight,Video,Camera,phoneSize,phoneSystem,Memorysize,PhoneDesc,Standbytime,ScreenSize,Frequency,InputMethod,Soundrecord,gps,fm,mp3,email,Infrared,game,clock,Calendar,Calculator,Bluetooth)   " );

        sql.Append( "  values (@pid,@TextPhoneName,@Textnum,@Textprice,@Dropphonetype2,@TextonSellTime,@Textcolor,@Textweight  " );
        
        .................

        SqlParameter[] paras  =  {  new  SqlParameter( " @pid " , SqlDbType.Int,  4 ) ,
             new  SqlParameter( " @TextPhoneName " , SqlDbType.NVarChar,  50 ) , 
             new  SqlParameter( " @Textnum " , SqlDbType.Int,  4 ) ,
             new  SqlParameter( " @Textprice " , SqlDbType.Int,  4 ) ,
             new  SqlParameter( " @Dropphonetype2 " , SqlDbType.VarChar,  20 ) ,
             new  SqlParameter( " @TextonSellTime " , SqlDbType.DateTime,  8 ) ,
             new  SqlParameter( " @Textcolor " , SqlDbType.VarChar,  20 ) ,
             new  SqlParameter( " @Textweight " , SqlDbType.NVarChar,  50 ) ,

           ...........
        };
         string [] stra  =  {Dropphonetype.SelectedValue,TextPhoneName.Text , Textnum.Text, Textprice.Text, Dropphonetype2.SelectedValue, TextonSellTime.Text, Textcolor.Text, Textweight.Text, 
            .............};

         int  a = stra.Length;
         int  j;
        
         for  ( j  =   0 ; j  <  a; j ++ )
        {
            paras[j].Value  =  stra[j];
           
        }
         int  strpid  =   0 ;
         string  sqla  =  sql.ToString();
         try
        {
            SqlHelper.ExcuteNonQurey(sqla, CommandType.Text, paras); // 执行添加数据
           
            strpid  =  Convert.ToInt32(SqlHelper.ExcuteSclare(sqla, CommandType.Text, paras));   // 获取刚才插入的id号


        }
         catch  (SqlException ex)
        {
            cmdreturn.Text  =  ex.Message.ToString();

        }

        cmdreturn.Text  =  strpid.ToString();

 

       RAISERROR ('不能修改或者添加',16,1);
       ROLLBACK TRANSACTION
end
go
3.通过URL传递的参数要用加密解密

传输
string szTmp = "safdsfdsafdsfytrsd";
szTmp = Server.UrlEncode(szTmp);
接收
STRING STRA=Server.UrlDecode(request.querystring(szTmp));

 

4.使用参数处理单引号，再放到SQL里面

例如 string stra=aa.replace("'","''")

  用参数化SQL可以不用处理单引号
  指定参数类型和过滤掉单引号，就可以杜绝99.9%入侵了

转载于:https://www.cnblogs.com/Excellentchen/archive/2010/02/05/1664127.html