SQL数据库注入防范 ASP.NET Globle警告
在项目中的Global.asax页面代码中加下面的代码,就可以有效的防范简单的SQL注入。
protected void Application_BeginRequest(Object sender, EventArgs e) { string Sql_1 = "exec |insert+ |select+ |delete |update |count |chr |mid |master+|truncate |char |declare |drop+ |drop+table |creat+ |creat+table |'+ |>=+|<+|>+|==+|-|'|;"; string Sql_2 = "exec+ |insert+ |delete+ |update+ |count( |count+ |chr+ |+mid( |+mid+ |+master+ |truncate+ |char+ |+char( |declare+ |drop+ |creat+ |drop+table |creat+table"; string[] sql_c = Sql_1.Split('|'); string[] sql_c1 = Sql_2.Split('|'); if (Request.QueryString != null) { foreach (string sl in sql_c) { if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= 0) { Response.Write("警告!你的IP已经被记录!");// Response.Write(sl); Response.Write(Request.QueryString.ToString()); Response.End(); break; } } } if (Request.Form.Count > 0) { string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称 if (Request.ServerVariables["HTTP_REFERER"] != null) { string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称 string s3 = ""; if (s1.Length > (s2.Length - 7)) { s3 = s2.Substring(7); } else { s3 = s2.Substring(7, s1.Length); } if (s3 != s1) { Response.Write("你的IP已被记录!警告!");// Response.End(); } } } }