防止sql攻击

using System.Web;
 2 using System.Configuration;
 3 
 4 namespace Moosoft.OA.HttpModule
 5 {
 6     /// <summary>
 7     /// SQL注入攻击防御类
 8     /// </summary>
 9     public class ProcessRequest
10     {
11         /// <summary>
12         /// 构造函数
13         /// </summary>
14         public ProcessRequest()
15         {
16             //
17             // TODO: 在此处添加构造函数逻辑
18             //
19         }
20 
21         #region SQL注入式攻击代码分析
22 
23         /// <summary>
24         /// 处理用户提交的请求
25         /// </summary>
26         public void StartProcessRequest()
27         {
28             try
29             {
30                 string getkeys = "";
31                 string sqlErrorPage = ConfigurationManager.AppSettings["CustomErrorPage"].ToString();
32                 if (HttpContext.Current.Request.QueryString != null)
33                 {
34 
35                     for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++)
36                     {
37                         getkeys = HttpContext.Current.Request.QueryString.Keys[i];
38                         if (!ProcessSqlStr(HttpContext.Current.Request.QueryString[getkeys]))
39                         {
40                             HttpContext.Current.Response.Redirect(sqlErrorPage + "?errmsg=sqlserver&sqlprocess=true");
41                             HttpContext.Current.Response.End();
42                         }
43                     }
44                 }
45                 if (HttpContext.Current.Request.Form != null)
46                 {
47                     for (int i = 0; i < HttpContext.Current.Request.Form.Count; i++)
48                     {
49                         getkeys = HttpContext.Current.Request.Form.Keys[i];
50                         if (!ProcessSqlStr(HttpContext.Current.Request.Form[getkeys]))
51                         {
52                             HttpContext.Current.Response.Redirect(sqlErrorPage + "?errmsg=sqlserver&sqlprocess=true");
53                             HttpContext.Current.Response.End();
54                         }
55                     }
56                 }
57             }
58             catch
59             {
60                 // 错误处理: 处理用户提交信息!
61             }
62         }
63         /// <summary>
64         /// 分析用户请求是否正常
65         /// </summary>
66         /// <param name="Str">传入用户提交数据</param>
67         /// <returns>返回是否含有SQL注入式攻击代码</returns>
68         private bool ProcessSqlStr(string Str)
69         {
70             bool ReturnValue = true;
71             try
72             {
73                 if (Str != "")
74                 {
75                     string SqlStr = "and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare ";
76                     string[] anySqlStr = SqlStr.Split('|');
77                     foreach (string ss in anySqlStr)
78                     {
79                         if (Str.ToLower().IndexOf(ss) >= 0)
80                         {
81                             ReturnValue = false;
82                         }
83                     }
84                 }
85             }
86             catch
87             {
88                 ReturnValue = false;
89             }
90             return ReturnValue;
91         }
92         #endregion
93 
94     }
95 }
96 // ConfigurationSettings.AppSettings["CustomErrorPage"].ToString(); 这个为用户自定义错误页面提示地址,
97 //在Web.Config文件时里面添加一个 CustomErrorPage 即可
98 //<!-- 防止SQL数据库注入攻击的出错页面自定义地址 -->
99 //<add key="CustomErrorPage" value="../Error.html" />