防止页面在跳转的时候被SQL注入

首先写一个SQL注入过滤的类：

public class SqlFilter { #region SQL注入式攻击代码分析 /// <summary> /// 处理用户提交的请求 /// </summary> public void StartProcessRequest() { string getkeys = ""; string sqlErrorPage = "~/no.html";//转向的错误提示页面 try { if (System.Web.HttpContext.Current.Request.QueryString != null) { for (int i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++) { getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i]; if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys])) { System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage,false); System.Web.HttpContext.Current.ApplicationInstance.CompleteRequest(); //System.Web.HttpContext.Current.Response.End(); } } } if (System.Web.HttpContext.Current.Request.Form != null) { for (int i = 0; i < System.Web.HttpContext.Current.Request.Form.Count; i++) { getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i]; if (getkeys == "__VIEWSTATE") continue; if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys])) { System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage,false); System.Web.HttpContext.Current.ApplicationInstance.CompleteRequest(); //System.Web.HttpContext.Current.Response.End(); } } } } catch(Exception ex) { System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage, false); System.Web.HttpContext.Current.ApplicationInstance.CompleteRequest(); //System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage); //System.Web.HttpContext.Current.Response.End(); // 错误处理: 处理用户提交信息! } } /// <summary> /// 分析用户请求是否正常 /// </summary> /// <param name="Str">传入用户提交数据 </param> /// <returns>返回是否含有SQL注入式攻击代码 </returns> public bool ProcessSqlStr(string Str) { bool ReturnValue = true; try { if (Str.Trim() != "") { string SqlStr = "and |exec |insert |delete |update |count |* |chr |mid |master |truncate |char |declare ";//|select string[] anySqlStr = SqlStr.Split('|'); foreach (string ss in anySqlStr) { if (Str.ToLower().IndexOf(ss) >= 0) { ReturnValue = false; break; } } } } catch { ReturnValue = false; } return ReturnValue; } #endregion }

 

然后添加一个Global.asax并添加如下代码

        protected void Application_BeginRequest(object sender, EventArgs e)
        {
            SqlFilter sqlFilter = new SqlFilter();
            sqlFilter.StartProcessRequest();
        }
这样就可以轻松的过滤掉由页面跳转带来的SQL注入。