防sql注入

最新推荐文章于 2022-07-25 22:18:00 发布

X_X_OO

最新推荐文章于 2022-07-25 22:18:00 发布

阅读量262

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/X_X_OO/article/details/52529222

string strSQL="SELECT * FROM [user] WHERE user_id=@id";
SqlCommand cmd = new SqlCommand();
cmd.CommandText = strSQL;
cmd.Parameters.Add("@id",SqlDbType.VarChar,20).Value=Request["id"].ToString();

过滤禁止运行法：

          /// <summary>
          /// 过滤SQL语句,防止注入
          /// </summary>
          /// <param name="strSql"></param>
          /// <returns>0 - 没有注入, 1 - 有注入 </returns>
          public int filterSql(string sSql)
          {
              int srcLen, decLen = 0;
              sSql = sSql.ToLower().Trim();
              srcLen = sSql.Length;
              sSql = sSql.Replace("exec", "");
              sSql = sSql.Replace("delete", "");
              sSql = sSql.Replace("master", "");
              sSql = sSql.Replace("truncate", "");
              sSql = sSql.Replace("declare", "");
              sSql = sSql.Replace("create", "");
              sSql = sSql.Replace("xp_", "no");
              decLen = sSql.Length;
              if (srcLen == decLen) return 0; else return 1;
          }