防SQL注入函数.docVIP

using System;using System.Text.RegularExpressions;using System.Web; namespace FSqlKeyWord{/**//**//**//// summary/// SqlKey 的摘要说明。/// /summarypublic class SqlKey{private HttpRequest request;private const string StrKeyWord = @select|insert|delete|from|count(|drop table|update|truncate|asc(|mid(|char(|xp_cmdshell|exec master|netlocalgroup administrators|:|net user||or|and;private const string StrRegex = @[-|;|,|/|(|)|[|]|}|{|%|@|*|!|];public SqlKey(System.Web.HttpRequest _request){//// TODO: 在此处添加构造函数逻辑//this.request = _request;} /**//**//**//// summary/// 只读属性 SQL关键字/// /summarypublic static string KeyWord{get{return StrKeyWord;}}/**//**//**//// summary/// 只读属性过滤特殊字符/// /summarypublic static string RegexString{get{return StrRegex;}}/**//**//**//// summary/// 检查URL参数中是否带有SQL注入可能关键字。/// /summary/// param name=_request当前HttpRequest对象/param/// returns存在SQL注入关键字true存在，false不存在/returnspublic bool CheckRequestQuery(){if (request.QueryString.Count != 0){//若URL中参数存在，逐个比较参数。for (int i = 0; i request.QueryString.Count; i++){// 检查参数值是否合法。if (CheckKeyWord(request.QueryString[i].ToString())){return true;}}}return false;} /**//**//**//// summary/// 检查提交表单中是否存在SQL注入可能关键字/// /summary/// param name=_request当前HttpRequest对象/param/// returns存在SQL注入关键字true存在，false不存在/returnspublic bool CheckRequestForm(){if (request.Form.Count 0){//获取提交的表单项不为0 逐个比较参数for (int i = 0; i request.Form.Count; i++){//检查参数值是否合法if (CheckKeyWord(request.Form[i])){//存在SQL关键字return true; }}}return false;} /**//**//**//// summary/// 静态方法，检查_sword是否包涵SQL关键字/// /summary/// param name=_sWord被检查的字符串/param/// returns存在SQL关键字返回true，不存在返回false/returnspublic static bool CheckKeyWord(string _sWord){if (Regex.IsMatch(_sWord, StrKeyWord, RegexOptions.IgnoreCase) || Regex.IsMatch(_sWord, StrRegex))return true;return false;} /**//**//**//// summary/// 反SQL注入:返回1无注入信息， 否则返回错误处理/// /summary/// returns返回1无注入信息，否则返回错误处理/returnspublic string