防SQL注入

最新推荐文章于 2024-09-15 23:28:35 发布

yunduan

最新推荐文章于 2024-09-15 23:28:35 发布

阅读量575

点赞数

分类专栏： SQL注入文章标签： sql string table insert delete application

SQL注入专栏收录该内容

4 篇文章 0 订阅

订阅专栏

protected void Application_BeginRequest(Object sender, EventArgs e)
    {
        //SQL防注入
        string Sql_1 = "exec |insert+ |select+ |delete |update |count |chr |mid |master+ |truncate |char |declare |drop+ |drop+table |creat+ |creat+table";
        string Sql_2 = "exec+ |insert+ |delete+ |update+ |count( |count+ |chr+ |+mid( |+mid+ |+master+ |truncate+ |char+ |+char( |declare+ |drop+ |creat+ |drop+table |creat+table";
        string[] sql_c = Sql_1.Split(' |');
        string[] sql_c1 = Sql_2.Split(' |');

        if (Request.QueryString != null)
        {
            foreach (string sl in sql_c)
            {
                if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= 0)
                {
                    Response.Write("警告！你的IP已经被记录!");//
                    Response.Write(sl);
                    Response.Write(Request.QueryString.ToString());
                    Response.End();
                    break;
                }
            }
        }

        if (Request.Form.Count > 0)
        {
            string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称
            if (Request.ServerVariables["HTTP_REFERER"] != null)
            {
                string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称
                string s3 = "";
                if (s1.Length > (s2.Length - 7))
                {
                    s3 = s2.Substring(7);
                }
                else
                {
                    s3 = s2.Substring(7, s1.Length);
                }
                if (s3 != s1)
                {
                    Response.Write("你的IP已被记录！警告！");//
                    Response.End();
                }
            }
        }
    }

Request.ServerVariables("HTTP_REFERER")

下列情况是从浏览器的地址栏正常取得Request.ServerVariables("HTTP_REFERER")的:
1.直接用<a href>
2.用Submit或<input type=image>提交的表单(POST or GET)
3.使用Jscript提交的表单(POST or GET)

下面我们再看看Request.ServerVariables("HTTP_REFERER")不能正常取值的情况:
1.从收藏夹链接
2.单击/''/''主页/''/''或者自定义的地址
3.利用Jscript的location.href or location.replace()
4.在浏览器直接输入地址
5.<%Response.Redirect%>
6.<%Response.AddHeader%>或<meta http-equiv=refresh>转向
7.用XML加载地址

显然，Request.ServerVariables("HTTP_REFERER")在多数情况下是不能正常工作的

public static string RemoveUnsafeHtml(string content)
        {
            content = Regex.Replace(content, @"(/ < |/s+)o([a-z]+/s?=)", "$1$2", RegexOptions.IgnoreCase);
            content = Regex.Replace(content, @"(script |frame |form |meta |behavior |style)([/s |: |>])+", "$1.$2", RegexOptions.IgnoreCase);
            return content;
        }

//检测是否是安全的sql字符串
public static bool IsSafeSqlString(string str)
        {

            return !(Regex.IsMatch(str, @"[- | |, |// |/( |/) |/[ |/] |/} |/{ |% |@ |/* |! |/']", RegexOptions.IgnoreCase) | | Regex.IsMatch(str, @"/s+exec(/s |/+)+(s |x)p/w+", RegexOptions.IgnoreCase));
        }

        // 过滤非法字符(防止sql注入)

        public static string SqlFilter(string sql)
        {
            if (!IsNullOrEmpty(sql) | | !IsSafeSqlString(sql))
            {
                string pattern = @"(/%27) |(/') |(/-/-)";
                string str2 = @"((/%27) |(/'))/s*((/%6F) |o |(/%4F))((/%72) |r |(/%52))";
                string str3 = @"/s+exec(/s |/+)+(s |x)p/w+";
                sql = Regex.Replace(sql, pattern, string.Empty, RegexOptions.IgnoreCase);
                sql = Regex.Replace(sql, str2, string.Empty, RegexOptions.IgnoreCase);
                sql = Regex.Replace(sql, str3, string.Empty, RegexOptions.IgnoreCase);
            }
            return sql;
        }