编写Asp.net防注入组件

 经常要写一些.net的程序，对于数据库的防注入要求要比较高。这时我从网上搜了一些代码。查看了一下主要是通过HTTPModel来进行对客户端转过来的数据进行处理。
       在服务器安全栏目里我写过一篇《破解通用Sql防注入方法》的文章中说到，一些通用的防注入方法中没有对cookie数据进行过滤，会给黑客留下可乘之机。当然我的这段代码对提交过来的cookie数据也进行了过滤。

代码：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141

using System; using System.Configuration; using System.Web; using System.Globalization; namespace JNYW.StuM.SqlInject {     public class SqlstrAny : IHttpModule     {                public void Init(HttpApplication application)         {             application.BeginRequest += (new             EventHandler(this.Application_BeginRequest));         }         private void Application_BeginRequest(Object source, EventArgs e)         {                       ProcessRequest pr = new ProcessRequest();             pr.StartProcessRequest();         }         public void Dispose()         {         }      }     public class ProcessRequest      {          private static string SqlStr = System.Configuration.ConfigurationManager.AppSettings["SqlInject"].ToString();          private static string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings["SQLInjectErrPage"].ToString();          ///          /// 用来识别是否是流的方式传输          ///          ///          ///          bool IsUploadRequest(HttpRequest request)          {              return StringStartsWithAnotherIgnoreCase(request.ContentType, "multipart/form-data");          }          ///          /// 比较内容类型          ///          ///          ///          ///          private static bool StringStartsWithAnotherIgnoreCase(string s1, string s2)          {              return (string.Compare(s1, 0, s2, 0, s2.Length, true, CultureInfo.InvariantCulture) == 0);          }                  //SQL注入式攻击代码分析          #region SQL注入式攻击代码分析          ///          /// 处理用户提交的请求          ///         public void StartProcessRequest()          {              HttpRequest Request = System.Web.HttpContext.Current.Request;              HttpResponse Response = System.Web.HttpContext.Current.Response;              try              {                  string getkeys = "";                  if (IsUploadRequest(Request)) return; //如果是流传递就退出 //字符串参数                  if (Request.QueryString != null)                  {                      for (int i = 0; i < Request.QueryString.Count; i++)                      {                          getkeys = Request.QueryString.Keys[i];                          if (!ProcessSqlStr(Request.QueryString[getkeys]))                          {                              Response.Redirect(sqlErrorPage + "?errmsg=QueryString中含有非法字符串&sqlprocess=true");                              Response.End();                          }                      }                  }                 //form参数                  if (Request.Form != null)                  {                      for (int i = 0; i < Request.Form.Count; i++)                      {                          getkeys = Request.Form.Keys[i];                          if (!ProcessSqlStr(Request.Form[getkeys]))                          {                              Response.Redirect(sqlErrorPage + "?errmsg=Form中含有非法字符串&sqlprocess=true");                              Response.End();                          }                      }                  }                //cookie参数                  if (Request.Cookies != null)                  {                      for (int i = 0; i < Request.Cookies.Count; i++)                      {                          getkeys = Request.Cookies.Keys[i];                          if (!ProcessSqlStr(Request.Cookies[getkeys].Value))                          {                              Response.Redirect(sqlErrorPage + "?errmsg=Cookie中含有非法字符串&sqlprocess=true");                              Response.End();                          }                      }                  }              }              catch              {                  // 错误处理: 处理用户提交信息!                  Response.Clear();                  Response.Write("CustomErrorPage配置错误");                  Response.End();              }          }                     ///          /// 分析用户请求是否正常          ///          /// 传入用户提交数据          /// 返回是否含有SQL注入式攻击代码          private bool ProcessSqlStr(string Str)          {              bool ReturnValue = true;              try              {                  if (Str != "")                  {                      string[] anySqlStr = SqlStr.Split('|');                      foreach (string ss in anySqlStr)                      {                          if (Str.IndexOf(ss) >= 0)                          {                              ReturnValue = false;                              break;                          }                      }                  }              }              catch              {                  ReturnValue = false;              }              return ReturnValue;          }          #endregion      } }

在实际使用时，我们要在Web.config文件中的配置节中加上下面的代码

以下是示例代码：

1 2 3

<!--防注入设置-->     <add value="and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare " key="SQLInject" /?     <add value="ShowErr.aspx" key="SQLInjectErrPage" />

并且在Web.Config文件的<SYSTEM.WEB>中再加上下面的代码。 以下是示例代码：

1 2 3 4

<!--防注入设置-->       <HTTPMODULES>            <addname="SqlstrAny" type="JNYW.StuM.SqlInject.SqlstrAny,SqlstrAny" />       </HTTPMODULES>