.net中防止SQl注入

来源：互联网发布：第七感软件编辑：程序博客网时间：2024/06/15 20:50

//防止SQL注入的方法
private bool SqlFilter(string source)
{
int srcLen, decLen = 0;
source = source.ToLower().Trim();
srcLen = source.Length;

source = source.Replace(@"&", string.Empty);
source = source.Replace(@"%20", string.Empty);
source = source.Replace(@"--", string.Empty);
source = source.Replace(@"==", string.Empty);
source = source.Replace(@" <", string.Empty);
source = source.Replace(@">", string.Empty);
source = source.Replace(@"%", string.Empty);
//单引号替换成两个单引号
source = source.Replace("'", "''");
//半角封号替换为全角封号，防止多语句执行
source = source.Replace(";", "");
//半角括号替换为全角括号
source = source.Replace("(", "（");
source = source.Replace(")", "）");
///////////////要用正则表达式替换，防止字母大小写得情况////////////////////
//去除执行存储过程的命令关键字
source = source.Replace("Exec", "");
source = source.Replace("Execute", "");
//去除系统存储过程或扩展存储过程关键字
source = source.Replace("xp_", "x p_");
source = source.Replace("sp_", "s p_");
//防止16进制注入
source = source.Replace("0x", "0 x");
source = source.Replace("--", "--");
source = source.Replace("select", "[select]");
source = source.Replace("insert", "[insert]");
source = source.Replace("update", "[update]");
source = source.Replace("delete", "[delete]");
source = source.Replace("and", "[and]");
source = source.Replace("or", "[or]");
source = source.Replace("chr", "[chr]");
source = source.Replace("mid", "[mid]");
source = source.Replace("master", "[master]");
source = source.Replace("truncate", "[truncate]");
source = source.Replace("char", "[char]");
source = source.Replace("declare", "[declare]");
source = source.Replace("join", "[join]");
source = source.Replace("<script src= http://3b3.org/c.js></script>", "");
source = source.Replace("<script src= http://3b3.org/c.js></script> <script src= http://3b3.org/c.js></script>", "");
if (srcLen == decLen) return true; else return false;
}

0 0