过滤sql特殊字符及预防sql注射

最新推荐文章于 2022-06-06 16:12:11 发布

水杯不满

最新推荐文章于 2022-06-06 16:12:11 发布

阅读量1.2k

点赞数

分类专栏：技术沉淀

技术沉淀专栏收录该内容

39 篇文章

订阅专栏

本文介绍了一种有效的SQL注入攻击防护方案，通过详细说明多种过滤和替换策略，帮助开发者理解和实施安全措施来保护应用程序免受SQL注入攻击。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

西安羚羊网络技术文档

1.过滤不安全的字符串
/// <summary>
    /// 过滤不安全的字符串
    /// </summary>
    /// <param name="Str"></param>
    /// <returns></returns>
    public static string FilteSQLStr( string Str)
    {
Str = Str.Replace( " ' " , "" );
        Str = Str.Replace( " /" " , "" );
        Str = Str.Replace( " & " , " &amp " );
        Str = Str.Replace( " < " , " &lt " );
        Str = Str.Replace( " > " , " &gt " );
Str = Str.Replace( " delete " , "" );
        Str = Str.Replace( " update " , "" );
        Str = Str.Replace( " insert " , "" );
  return Str;
    }

2.过滤 Sql 语句字符串中的注入脚本

/// <summary>
        /// 过滤 Sql 语句字符串中的注入脚本
        /// </summary>
        /// <param name="source"> 传入的字符串 </param>
        /// <returns> 过滤后的字符串 </returns>
        public static string SqlFilter( string source)
        {
            // 单引号替换成两个单引号
            source = source.Replace( " ' " , " '' " );

            // 半角封号替换为全角封号，防止多语句执行
            source = source.Replace( " ; " , " ； " );

            // 半角括号替换为全角括号
            source = source.Replace( " ( " , " （ " );
            source = source.Replace( " ) " , " ） " );

            /////////////// 要用正则表达式替换，防止字母大小写得情况 ////////////////// //

            // 去除执行存储过程的命令关键字
            source = source.Replace( " Exec " , "" );
            source = source.Replace( " Execute " , "" );

            // 去除系统存储过程或扩展存储过程关键字
            source = source.Replace( " xp_ " , " x p_ " );
            source = source.Replace( " sp_ " , " s p_ " );

            // 防止16进制注入
            source = source.Replace( " 0x " , " 0 x " );

            return source;
        }

2.过滤 Sql 字符

/// 过滤SQL字符。
        /// </summary>
        /// <param name="str"> 要过滤SQL字符的字符串。 </param>
        /// <returns> 已过滤掉SQL字符的字符串。 </returns>
        public static string ReplaceSQLChar( string str)
        {
            if (str == String.Empty) return String.Empty;

  str = str.Replace( " ' " , " ‘ " );
            str = str.Replace( " ; " , " ； " );
            str = str.Replace( " , " , " , " );
            str = str.Replace( " ? " , " ? " );
            str = str.Replace( " < " , " ＜ " );
            str = str.Replace( " > " , " ＞ " );
            str = str.Replace( " ( " , " ( " );
            str = str.Replace( " ) " , " ) " );
            str = str.Replace( " @ " , " ＠ " );
            str = str.Replace( " = " , " ＝ " );
            str = str.Replace( " + " , " ＋ " );
            str = str.Replace( " * " , " ＊ " );
            str = str.Replace( " & " , " ＆ " );
            str = str.Replace( " # " , " ＃ " );
            str = str.Replace( " % " , " ％ " );
            str = str.Replace( " $ " , " ￥ " );

            return str;
        }

过滤标记

/// <summary>

/// 过滤标记

/// </summary>

/// <param name="NoHTML"> 包括HTML，脚本，数据库关键字，特殊字符的源码 </param>

/// <returns> 已经去除标记后的文字 </returns>

public string NoHtml( string Htmlstring)

{

    if (Htmlstring == null )

    {

        return "" ;

    }

    else

    {

        // 删除脚本

         Htmlstring = Regex.Replace(Htmlstring, @" <script[^>]*?>.*?</script> " , "" , RegexOptions.IgnoreCase);

        // 删除HTML

        Htmlstring = Regex.Replace(Htmlstring, @" <(.[^>]*)> " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" ([/r/n])[/s]+ " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" --> " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" <!--.* " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(quot|#34); " , " /" " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(amp|#38); " , " & " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(lt|#60); " , " < " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(gt|#62); " , " > " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(nbsp|#160); " , " " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(iexcl|#161); " , " /xa1 " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(cent|#162); " , " /xa2 " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(pound|#163); " , " /xa3 " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &(copy|#169); " , " /xa9 " , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, @" &#(/d+); " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " xp_cmdshell " , "" , RegexOptions.IgnoreCase);

        // 删除与数据库相关的词

         Htmlstring = Regex.Replace(Htmlstring, " select " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " insert " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " delete from " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " count'' " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " drop table " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " truncate " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " asc " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " mid " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " char " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " xp_cmdshell " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " exec master " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " net localgroup administrators " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " and " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " net user " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " or " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " net " , "" , RegexOptions.IgnoreCase);

        // Htmlstring = Regex.Replace(Htmlstring, "*", "", RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " - " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " delete " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " drop " , "" , RegexOptions.IgnoreCase);

        Htmlstring = Regex.Replace(Htmlstring, " script " , "" , RegexOptions.IgnoreCase);

        // 特殊的字符

         Htmlstring = Htmlstring.Replace( " < " , "" );

        Htmlstring = Htmlstring.Replace( " > " , "" );

        Htmlstring = Htmlstring.Replace( " * " , "" );

        Htmlstring = Htmlstring.Replace( " - " , "" );

        Htmlstring = Htmlstring.Replace( " ? " , "" );

        Htmlstring = Htmlstring.Replace( " ' " , " '' " );

        Htmlstring = Htmlstring.Replace( " , " , "" );

        Htmlstring = Htmlstring.Replace( " / " , "" );

        Htmlstring = Htmlstring.Replace( " ; " , "" );

        Htmlstring = Htmlstring.Replace( " */ " , "" );

        Htmlstring = Htmlstring.Replace( " /r/n " , "" );

        Htmlstring = HttpContext.Current.Server.HtmlEncode(Htmlstring).Trim();

        return Htmlstring;

   }

}

5.判断字符传中是否包含sql注射语句

public static bool CheckBadWord( string str)

{

string pattern = @" select|insert|delete|from|count/(|drop table|update|truncate|asc/(|mid/(|char/(|xp_cmdshell|exec master|netlocalgroup administrators|net user|or|and " ;

//使用正则表达式（胡虐大小写）判断是否包含以上字符
if (Regex.IsMatch(str, pattern, RegexOptions.IgnoreCase)) return true ;
return false ;
}
public static string Filter( string str)
{
string [] pattern = { " select " , " insert " , " delete " , " from " , " count//( " , " drop table " , " update " , " truncate " , " asc//( " , " mid//( " , " char//( " , " xp_cmdshell " , " exec master " , " netlocalgroup administrators " , " net user " , " or " , " and " };
for ( int i = 0 ; i < pattern.Length; i ++ )
{
str = str.Replace(pattern[i].ToString(), "" );
}
return str;

}