using
System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Text.RegularEx
Pressions;
/// <summary>
///SQLInjectionHelper 的摘要说明
/// </summary>
p
ublic class SQLInjectionHelper
{
/// <summary>
/// 获取Post的数据
/// </summary>
/// <par
am name="request"></param>
/// <returns></returns>
public
static bool ValidUrlData(string request)
{
bool result = false;
if (request
== "POST")
{
for (int i = 0; i < HttpContext.
current.Request.Form.Count;
i++)
{
result = ValidData(HttpContext.Current.Request.Form[i].ToString());
if (result)
{
break;
}
}
}
else
{
for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++)
{
result = ValidData(HttpContext.Current.Request.QueryString[i].ToString());
if (result)
{
break;
}
}
}
return result;
}
/// <summary>
/// 验证
是否存在注入代码
/// </summary>
/// <param name="inputData"></param>
/// <returns></returns>
PRivate static bool ValidData(string inputData)
{
//验证inputData是否包含恶意集合
if (Regex.IsMatch(inputData, GetRegexString()))
{
return true;
}
else
{
return false;
}
}
/// <summary>
/// 获取正则表达式
/// </summary>
/// <returns></returns>
private static string GetRegexString()
{
//构造SQL的注入关键字符
string[] strChar = { "and", "exec", "insert", "select", "update", "delete", "count", "
From", "drop", "asc", "or", "char", "%", ";", ":", "\'", "\"", "-", "c
hr", "master", "mid", "truncate", "declare", "char", "S
ITeName", "/add", "
xp_cmdshell", "net user", "net localgroup administrators", "exec master.dbo.xp_cmdshell" };
string str_Regex = ".*(";
for (int i = 0; i < strChar.Length - 1; i++)
{
str_Regex += strChar[i] + "|";
}
str_Regex += strChar[strChar.Length - 1] + ").*";
return str_Regex;
}
}
<%@ Page Language="C
#" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="_Default" %>
<!DOCTYPE ht
ML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.
org/TR/xhtml1/DTD/xhtml1
-transitional.dtd">
<html
XMlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>
<br />
<asp:Button ID="
BTnPost" runat="server" Text="获取
POST数据"
onclick="btnPost_Click" />
</div>
<asp:Button ID="btnGet" runat="server" Text="获取Get数据" onclick="btnGet_Click" />
</form>
</body>
</html>
protected void btnPost_Click(object sender, EventArgs e)
{
}
protected void btnGet_Click(object sender, EventArgs e)
{
Response.
redirect("Default.aspx?a=1&am
p;b=2&c=3");
}