一套基于asp.net的安全校验机制应用模型！

using System;
using System.Data;
using System.Configuration;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;

using System.IO;
using System.Text;
using System.Web.UI.MobileControls;
using System.Collections.Generic;

/// <summary>
///SQLFilter 的摘要说明
/// </summary>
public static class SQLFilter
{

    #region SQL注入过滤
    /// <summary>
    /// SQL注入过滤
    /// </summary>
    /// <param name="sqlParems">要过滤的参数数组</param>
    /// <returns>如果参数存在不安全字符，则返回false</returns>
    public static bool SqlFilter(string[] sqlParems, Page p)
    {
        StringBuilder parems = new StringBuilder();

        //常用的SQL恶意字符屏蔽
        string sql = "insert|delete|update|select|exec|script";
        try
        {
            //获取配置在Web.config中最新的SQL恶意字符屏蔽
            sql = System.Configuration.ConfigurationSettings.AppSettings["SQLFilter"].ToString();
        }
        catch (Exception)
        {
            //对于配置文件的错误配置，将采用常用的SQL恶意字符屏蔽
            sql = "insert|delete|update|select|exec|script";
        }
   
        foreach (string var in SetAllsqlParems(sqlParems,p))
        {
            foreach (string i in sql.Split('|'))
            {
                if (var.IndexOf(i.ToLower()) > -1)
                {
                    try
                    {

　　　　　　　　//创建非法记录日志
                        using (FileStream file = new FileStream(System.Web.HttpContext.Current.Server.MapPath("~\\" + DateTime.Now.ToString("yyyy年MM月dd日") + "非法数据记录.txt"), FileMode.Append))
                        {
                            StreamWriter sw = new StreamWriter(file);

                            foreach (string value in SetAllsqlParems(sqlParems, p))
                            {
                                parems.Append(" [" + value + "] ");
                            }
                            sw.WriteLine(DateTime.Now.ToString("HH:mm:ss") + "  IP：[" + p.Request.UserHostAddress + "]    原始URL：[" + p.Request.Url + "]   非法字符：[" + var + "：" + i + "]   全部参数：" + parems.ToString());
                            sw.WriteLine();

                            sw.Close();
                            file.Close();
                        }
                    }
                    catch (Exception) { }
                    return false;
                }
            }
        }

        return true;
    }
    #endregion

 

    #region 需要校验的数据集合整理
    public static string[] SetAllsqlParems(string[] sqlParems, Page p)
    {
        List<string> list = new List<string>();

        if (sqlParems != null)
        {
            foreach (string var in sqlParems)
            {
                if (var == null || var.Equals(""))
                {}
                else
                {
                    list.Add(var.Trim().ToLower());
                }
            }
        }

        foreach (Control var in p.Form.Controls)
        {
            if (var.GetType() == typeof(System.Web.UI.WebControls.TextBox))
            {
                string text = ((System.Web.UI.WebControls.TextBox)var).Text.Trim().ToLower();
                if (text == null || text.Equals(""))
                {}
                else
                {
                    list.Add(text);
                }
            }
        }

        return list.ToArray();
    }
    #endregion

}

 

 

    // 应用示例
    // if(TheManagerUtils.SqlFilter(new string[] { "userName","pass;delete" }, this.Page) == false)
    // {
    //     //直接跳转到相应的错误页面
    //     Response.Redirect("WelfarePage.aspx");
    //     return;
    // }

    // if(TheManagerUtils.SqlFilter(null, this.Page) == false)
    // {
    //     //直接跳转到相应的错误页面
    //     Response.Redirect("WelfarePage.aspx");
    //     return;
    // }