asp.net 仿SQL注入

本文介绍了一种用于检测和防御SQL注入攻击的方法。该方法通过检查特定的SQL关键字来阻止潜在的恶意输入,同时记录非法尝试的详细信息,包括操作IP、时间及提交的数据等。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

using System;   
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Data.SqlClient;
/// <summary>
/// SqlCheck 的摘要说明
/// </summary>
///
namespace cofcms
{
public class SqlCheck
{

public void CheckSql()
{

string jk1986_sql = "exec↓select↓drop↓alter↓exists↓union↓and↓or↓xor↓order↓mid↓asc↓execute↓xp_cmdshell↓insert↓update↓delete↓join↓declare↓char↓sp_oacreate↓wscript.shell↓xp_regwrite↓'↓;↓--";
string[] jk_sql = jk1986_sql.Split('↓');
foreach (string jk in jk_sql)
{
// -----------------------防 Post 注入-----------------------
if (System.Web.HttpContext.Current.Request.Form != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作!系统做了如下记录 ↓" + "<br>");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操 作 I P :" + getip + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 时 间:" + DateTime.Now.ToString() + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 页 面:" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 方 式:P O S T " + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 参 数:" + jk + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 数 据:" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + "<br>");
System.Web.HttpContext.Current.Response.End();
}
}
}
// -----------------------防 GET 注入-----------------------
if (System.Web.HttpContext.Current.Request.QueryString != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作!系统做了如下记录 ↓" + "<br>");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操 作 I P :" + getip + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 时 间:" + DateTime.Now.ToString() + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 页 面:" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 方 式:G E T " + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 参 数:" + jk + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 数 据:" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + "<br>");
System.Web.HttpContext.Current.Response.End();
}
}
}
// -----------------------防 Cookies 注入-----------------------
if (System.Web.HttpContext.Current.Request.Cookies != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作!系统做了如下记录 ↓" + "<br>");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操 作 I P :" + getip + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 时 间:" + DateTime.Now.ToString() + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 页 面:" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 方 式: Cookies " + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 参 数:" + jk + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 数 据:" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + "<br>");
System.Web.HttpContext.Current.Response.End();
}
}
}
}
}
}
}
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值