在Global.asax文件里实现通用防SQL注入漏洞程序(适应于post/get请求)

可使用Global.asax中的Application_BeginRequest(object sender, EventArgs e)事件来实现表单或者URL提交数据的获取，获取后传给SQLInjectionHelper类ValidUrlData方法来完成检查。

首先，创建一个SQLInjectionHelper类完成恶意代码的检查

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Text.RegularExpressions;
/// <summary>
///SQLInjectionHelper 的摘要说明
/// </summary>
public class SQLInjectionHelper
{
    /// <summary>
    /// 获取Get或Post的数据
    /// </summary>
    /// <param name="request"></param>
    /// <returns></returns>
    public static bool ValidUrlData(string request)
    {
        bool result = false;
        if (request == "POST")
        {
            for (int i = ; i < HttpContext.Current.Request.Form.Count; i++)
            {
                result = ValidData(HttpContext.Current.Request.Form[i].ToString());
                if (result)
                {
                    break;
                }
            }
        }
        else
        {
            for (int i = ; i < HttpContext.Current.Request.QueryString.Count; i++)
            {
                result = ValidData(HttpContext.Current.Request.QueryString[i].ToString());
                if (result)
                {
                    break;
                }
            }
        }
        return result;
    }
    /// <summary>
    /// 验证是否存在注入代码
    /// </summary>
    /// <param name="inputData"></param>
    /// <returns></returns>
    private static bool ValidData(string inputData)
    {
        //验证inputData是否包含恶意集合
        if (Regex.IsMatch(inputData, GetRegexString()))
        {
            return true;
        }
        else
        {
            return false;
        }
    }
    /// <summary>
    /// 获取正则表达式
    /// </summary>
    /// <returns></returns>
    private static string GetRegexString()
    {
        //构造SQL的注入关键字符，可根据情况自行增减
        string[] strChar = { "and", "exec", "insert", "select", "update", "delete", "count", "from", "drop", "asc", "or", "char", "%", ";", ":", "\'", "\"", "-", "chr", "master", "mid", "truncate", "declare", "char", "SiteName", "/add", "xp_cmdshell", "net user", "net localgroup administrators", "exec master.dbo.xp_cmdshell" };
        string str_Regex = ".*(";
        for (int i = ; i < strChar.Length - ; i++)
        {
            str_Regex += strChar[i] + "|";
        }
        str_Regex += strChar[strChar.Length - ] + ").*";
        return str_Regex;
    }
}

有此类后即可使用Global.asax中的Application_BeginRequest(object sender, EventArgs e)事件来实现表单或者URL提交数据的获取，获取后传给SQLInjectionHelper类ValidUrlData方法来完成检查 。

protected void Application_BeginRequest(object sender, EventArgs e)
{
    bool result = false;
    result = SQLInjectionHelper.ValidUrlData(Request.RequestType.ToUpper());
    if (result)
    {
        Response.Write("您提交的数据有恶意字符");
        Response.End();
    }
}