Global.asax.cs防注入问题

来源：互联网发布：天谕捏脸大赛数据编辑：程序博客网时间：2024/05/16 12:29

Global.asax.cs防注入问题

如果对参数没做处理，可以用下面的放在Global中防注入

protected void Application_BeginRequest(Object sender, EventArgs e) { //SQL防注入 string Sql_1 = "exec ¦insert+ ¦select+ ¦delete ¦update ¦count ¦chr ¦mid ¦master+ ¦truncate ¦char ¦declare ¦drop+ ¦drop+table ¦creat+ ¦creat+table"; string Sql_2 = "exec+ ¦insert+ ¦delete+ ¦update+ ¦count( ¦count+ ¦chr+ ¦+mid( ¦+mid+ ¦+master+ ¦truncate+ ¦char+ ¦+char( ¦declare+ ¦drop+ ¦creat+ ¦drop+table ¦creat+table"; string[] sql_c = Sql_1.Split('¦'); string[] sql_c1 = Sql_2.Split('¦'); if (Request.QueryString != null) { foreach (string sl in sql_c) { if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= 0) { Response.Write("警告！你的IP已经被记录!");// Response.Write(sl); Response.Write(Request.QueryString.ToString()); Response.End(); break; } } } if (Request.Form.Count > 0) { string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称 if (Request.ServerVariables["HTTP_REFERER"] != null) { string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称 string s3 = ""; if (s1.Length > (s2.Length - 7)) { s3 = s2.Substring(7); } else { s3 = s2.Substring(7, s1.Length); } if (s3 != s1) { Response.Write("你的IP已被记录！警告！");// Response.End(); } } } }