ASP.NET防SQL注入脚本程序 v2.0

最新推荐文章于 2018-01-12 00:42:54 发布

转载最新推荐文章于 2018-01-12 00:42:54 发布 · 1.2k 阅读

文章标签：

#asp.net #sql #脚本 #string #dataset #null

Asp.Net 专栏收录该内容

65 篇文章

订阅专栏

本文介绍了一个使用C#实现的SQL注入防护机制，通过检查HTTP请求中的潜在恶意字符串来阻止SQL注入攻击。该机制覆盖了POST、GET及Cookies数据。

public class SqlCheck { public SqlCheck() { // // TODO: 在此处添加构造函数逻辑 // } public SqlConnection oconn() { SqlConnection conn = new SqlConnection(); conn.ConnectionString = ConfigurationManager.ConnectionStrings["StudyConnectionString"].ToString(); //第1种调用的方法 JK1986_CheckSql(); JK1986_CheckSql(); if ( conn.State == ConnectionState.Closed ) { conn.Open(); } return conn; } public DataTable getsource(string getds) { SqlConnection conn = oconn(); SqlDataAdapter da = new SqlDataAdapter(getds, conn); DataSet ds = new DataSet(); da.Fill(ds,"news" ); return ds.Tables["news"]; } public static void JK1986_CheckSql() { string jk1986_sql = "exec↓select↓drop↓alter↓exists↓union↓and↓or↓xor↓order↓mid↓asc↓execute↓xp_cmdshell↓insert↓update↓delete↓join↓declare↓char↓sp_oacreate↓wscript.shell↓xp_regwrite↓'↓;↓--"; string[] jk_sql = jk1986_sql.Split('↓'); foreach (string jk in jk_sql) { // -----------------------防 Post 注入----------------------- if ( System.Web.HttpContext.Current.Request.Form != null) { for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++) { string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k]; string getip; if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true) { System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓//n//nBlog:http://hi.baidu.com/ahhacker86 //n//nBy:aa && JK1986');</" + "script>"); System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " "); if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null) { getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"]; } else { getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"]; } System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " "); System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " "); System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " "); System.Web.HttpContext.Current.Response.Write("提交方式：P O S T " + " "); System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " "); System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + " "); System.Web.HttpContext.Current.Response.End(); } } } // -----------------------防 GET 注入----------------------- if (System.Web.HttpContext.Current.Request.QueryString != null) { for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++) { string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k]; string getip; if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true) { System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓//n//nBlog:http://hi.baidu.com/ahhacker86 //n//nBy:aa && JK1986');</" + "script>"); System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " "); if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null) { getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"]; } else { getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"]; } System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " "); System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " "); System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " "); System.Web.HttpContext.Current.Response.Write("提交方式：G E T " + " "); System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " "); System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + " "); System.Web.HttpContext.Current.Response.End(); } } } // -----------------------防 Cookies 注入----------------------- if (System.Web.HttpContext.Current.Request.Cookies != null) { for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++) { string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k]; string getip; if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true) { System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓//n//nBlog:http://hi.baidu.com/ahhacker86 //n//nBy:aa && JK1986');</" + "script>"); System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " "); if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null) { getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"]; } else { getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"]; } System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " "); System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " "); System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " "); System.Web.HttpContext.Current.Response.Write("提交方式： Cookies " + " "); System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " "); System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + " "); System.Web.HttpContext.Current.Response.End(); } } } } } }