using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Data.SqlClient;
/// <summary>
/// SqlCheck 的摘要说明
/// </summary>
///
namespace cofcms
{
public class SqlCheck
{
public void CheckSql()
{
string jk1986_sql = "exec↓select↓drop↓alter↓exists↓union↓and↓or↓xor↓order↓mid↓asc↓execute↓xp_cmdshell↓insert↓update↓delete↓join↓declare↓char↓sp_oacreate↓wscript.shell↓xp_regwrite↓'↓;↓--";
string[] jk_sql = jk1986_sql.Split('↓');
foreach (string jk in jk_sql)
{
// -----------------------防 Post 注入-----------------------
if (System.Web.HttpContext.Current.Request.Form != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作!系统做了如下记录 ↓" + "<br>");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操 作 I P :" + getip + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 时 间:" + DateTime.Now.ToString() + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 页 面:" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 方 式:P O S T " + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 参 数:" + jk + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 数 据:" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + "<br>");
System.Web.HttpContext.Current.Response.End();
}
}
}
// -----------------------防 GET 注入-----------------------
if (System.Web.HttpContext.Current.Request.QueryString != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作!系统做了如下记录 ↓" + "<br>");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操 作 I P :" + getip + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 时 间:" + DateTime.Now.ToString() + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 页 面:" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 方 式:G E T " + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 参 数:" + jk + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 数 据:" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + "<br>");
System.Web.HttpContext.Current.Response.End();
}
}
}
// -----------------------防 Cookies 注入-----------------------
if (System.Web.HttpContext.Current.Request.Cookies != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('请勿提交非法字符!');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作!系统做了如下记录 ↓" + "<br>");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操 作 I P :" + getip + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 时 间:" + DateTime.Now.ToString() + "<br>");
System.Web.HttpContext.Current.Response.Write("操 作 页 面:" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 方 式: Cookies " + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 参 数:" + jk + "<br>");
System.Web.HttpContext.Current.Response.Write("提 交 数 据:" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + "<br>");
System.Web.HttpContext.Current.Response.End();
}
}
}
}
}
}
}
分享到:
相关推荐
详细的介绍了防止sql注入攻击,内附asp.net 源码和vb.net源码。是初学者不错的选择。希望能够帮助到你。
Asp.Net通用Sql防注入源码 Asp.Net程序员预防程序被sql注入攻击的必备知识.
学习代码 ASP.Net C# SQL注入 跨脚步漏洞 案例
ASP.NET防SQL注入脚本程序 ASP.NET防SQL注入脚本程序
防SQL注入DEMO,防SQL注入DEMO,防SQL注入DEMO
基于ASP.NET下SQL注入攻击防范与应用
protected void Application_BeginRequest(object sender, EventArgs e) { //遍历Post参数,隐藏域除外 foreach (string i in this.Request.Form) { if (i == "__VIEWSTATE") continue; this.goErr(this....
ASP.NET防止SQL注入函数,C harp代码
常用的asp.net的SQL防注入过滤函数大集合,实用性很高! 执行效率不错!
ASP.NET中如何防范SQL注入式攻击 自己看,共3页,感觉还是有点用处
史上最全的.net 防止sql注入攻击的替换文本
【ASP.NET编程知识】ASP.NET过滤类SqlFilter,防止SQL注入 .docx
一、什么是SQL注入式攻击? SQL注入式攻击就是攻击者把SQL命令插入到Web表单的输入域或页面请求的查询字符串,欺骗服务器执行恶意的SQL命令。在某些表单中,用户输入的内容直接用来构造(或者影响)动态SQL命令,...
asp.net防sql注入,很实用。主要页面提交时候进行判断
asp.net简单防范sql注入漏洞 防止 sql注入攻击 1 限制 文本框的最大长度 2 删除用户的单引号 3 处理sql注入的另外一个方法是 使用ado.net command对象的参数集合。 而不是评接多个字符串
ASP.NET源码——通用防SQL注入漏洞程序(Global.asax方式).zip
【ASP.NET编程知识】ASP.NET防止SQL注入的方法示例.docx
简单的asp.net登陆sql防注入功能是由一个if语句实现
ASP.NET的SQL注入攻击及防御.pdf
基于ASP.NET的SQL注入分析及防范,宁璇,,本文介绍了SQL注入攻击的概念和攻击方式,总结了一套有效的防御方案,并通过ASP.NET开发的WEB应用程序对该方案进行了验证,极大地减