aspx页面怎么防御SQL注入JS码?
最新回答
千夜残夏
2021-01-11 09:40:47
诺贝尔可爱奖
2023-08-08 11:20:38
/// 防注入字符串检查
/// </summary>
/// <param name= "str "> 待检查的字符串 </param>
/// <returns> </returns>
public static bool StringCheck(string str)
{
if (str.Trim() == " " || str == null)
{
return true;
}
else
{
Regex re = new Regex(@ "\s ");
str = re.Replace(str.Replace( "%20 ", " "), " ");
string pattern = @ "select |insert |delete from |count\(|drop table|update |truncate |asc\(|mid\(|char\(|xp_cmdshell|exec master|net localgroup administrators|:|net user| " "|\ '| or ";
if (Regex.IsMatch(str, pattern))
{
return false;
}
else
{
return true;
}
}
}
通常我都不用,都是直接用存储过程或则使用带参数的Sql语句
栖止你掌
2022-06-07 09:26:04
/// sql验证
/// </summary>
public class SQLValidate
{
private string[] SQL_Var = { "'", "and", "exec", "insert", "select", "delete", "update", "count", "*", "%", "chr", "mid", "master", "truncate","char","declare" };
public bool SqlVal(string sql)
{
for (int i = 0; i < SQL_Var.Length; i++)
{
if (sql.Contains(SQL_Var[i]))
{
return false;
}
}
return true;
}
}
热门标签
