SQL注入攻击之关键字检测

最近悟出来一个道理，在这儿分享给大家：学历代表你的过去，能力代表你的现在，学习代表你的将来。我们都知道计算机技术发展日新月异，速度惊人的快，你我稍不留神，就会被慢慢淘汰！因此：每日不间断的学习是避免被淘汰的不二法宝。

十年河东十年河西，莫欺少年穷！

无聊，随便来点代码，刷刷成就感@

1、SQL注入攻击防范之关键字过滤

   #region sql注入攻击
        public static string[] words = { "select", "insert", "delete", "count(", "drop table", "update", "truncate", "asc(", "mid(", "char(", "xp_cmdshell", "exec", "master", "net", "and", "or", "where" };

        public static string CheckParam(string Value)
        {
            Value = Value.Replace("'", "");
            Value = Value.Replace(";", "");
            Value = Value.Replace("--", "");
            Value = Value.Replace("/**/", "");
            return Value;
        }
        public static string CheckParamThrow(string Value)
        {
            for (int i = ; i < words.Length; i++)
            {
                if (Value.IndexOf(words[i], StringComparison.OrdinalIgnoreCase) > )
                {
                    string pattern = string.Format(@"[\W]{0}[\W]", words[i]);
                    Regex rx = new Regex(pattern, RegexOptions.IgnoreCase);
                    if (rx.IsMatch(Value))
                        throw new Exception("发现sql注入痕迹!");
                }
            }
            return CheckParam(Value);
        }
        /// <summary>
        /// 查找是否含有非法参数
        /// </summary>
        /// <param name="Value"></param>
        /// <returns></returns>
        public static bool CheckParamBool(string Value)
        {
            for (int i = ; i < words.Length; i++)
            {
                if (Value.IndexOf(words[i], StringComparison.OrdinalIgnoreCase) > )
                    return true;
            }
            return false;
        }
        #endregion

2、C#获取公网IP的方法

#region IP地址处理
        /// <summary>
        /// 取得客户端真实IP。如果有代理则取第一个非内网地址
        /// by flower.b
        /// </summary>
        public static string IPAddress
        {
            get
            {
                string result = String.Empty;

                result = HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
                if (result != null && result != String.Empty)
                {
                    //可能有代理
                    if (result.IndexOf(".") == -)    //没有“.”肯定是非IPv4格式
                        result = null;
                    else
                    {
                        if (result.IndexOf(",") != -)
                        {
                            //有“,”，估计多个代理。取第一个不是内网的IP。
                            result = result.Replace(" ", "").Replace("'", "");
                            string[] temparyip = result.Split(",;".ToCharArray());
                            for (int i = ; i < temparyip.Length; i++)
                            {
                                if (IsIPAddress(temparyip[i])
                                    && temparyip[i].Substring(, ) != "10."
                                    && temparyip[i].Substring(, ) != "192.168"
                                    && temparyip[i].Substring(, ) != "172.16.")
                                {
                                    return temparyip[i];    //找到不是内网的地址
                                }
                            }
                        }
                        else if (IsIPAddress(result)) //代理即是IP格式
                            return result;
                        else
                            result = null;    //代理中的内容 非IP，取IP
                    }

                }
                string IpAddress = (HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null && HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != String.Empty) ? HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] : HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
                if (null == result || result == String.Empty)
                    result = HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];

                if (result == null || result == String.Empty)
                    result = HttpContext.Current.Request.UserHostAddress;
                return result;
            }
        }

        /// <summary>
        /// 判断是否是IP地址格式 0.0.0.0
        /// </summary>
        /// <param name="str1">待判断的IP地址</param>
        /// <returns>true or false</returns>
        private static bool IsIPAddress(string str1)
        {
            if (str1 == null || str1 == string.Empty || str1.Length <  || str1.Length > ) return false;

            string regformat = @"^d{1,3}[.]d{1,3}[.]d{1,3}[.]d{1,3}$";

            Regex regex = new Regex(regformat, RegexOptions.IgnoreCase);
            return regex.IsMatch(str1);
        }
        #endregion

3、站点URL基本信息处理

#region 站点的基本url信息

        /// <summary>
        /// 获取当前网站根地址 http://wwww.baidu.com
        /// </summary>
        public static string GetRootUrl()
        {
            return "http://" + HttpContext.Current.Request.Url.Host;
        }

        /// <summary>
        /// 获得网站的根目录的url,比如http://www.baidu.com
        /// </summary>
        /// <returns></returns>
        public static string getWebSite()
        {
            string website = "http://" + HttpContext.Current.Request.Url.Authority;
            return website;
        }

        /// <summary>
        /// 设当前页完整地址
        /// 比如：http://www.jb51.net/aaa/bbb.aspx?id=5&name=kelli
        /// </summary>
        /// <returns></returns>
        public static string getTotalUrl()
        {
            string url = HttpContext.Current.Request.Url.ToString();
            return url;

        }
        /// <summary>
        /// 取得网站根目录的物理路径
        /// </summary>
        /// <returns></returns>
        public static string GetRootPath()
        {
            string AppPath = "";
            HttpContext HttpCurrent = HttpContext.Current;
            if (HttpCurrent != null)
            {
                AppPath = HttpCurrent.Server.MapPath("~");
            }
            else
            {
                AppPath = AppDomain.CurrentDomain.BaseDirectory;
                if (Regex.Match(AppPath, @"\\$", RegexOptions.Compiled).Success)
                    AppPath = AppPath.Substring(, AppPath.Length - );
            }
            return AppPath;
        }

        #endregion

4、检索文件、文件夹

#region 检索文件
        static System.Collections.ArrayList alst;
        /// <summary>
        /// 检索文件
        /// </summary>
        /// <param name="dir">目录</param>
        /// <param name="Filetype">文件类型 .css  .jpg</param>
             ///  foreach (string f in readlist(Server.MapPath(@"/Manger/")))//xiaobaigang为文件夹名称
            ///{
           ///    Response.Write(f);
          ///    //this.ListBox1.Items.Add(f);
         ///}
        public static void GetFiles(string dir,string Filetype)
        {
            try
            {
                string[] files = Directory.GetFiles(dir);//得到文件
                foreach (string file in files)//循环文件
                {
                    string exname = file.Substring(file.LastIndexOf(".") + );//得到后缀名
                    // if (".txt|.aspx".IndexOf(file.Substring(file.LastIndexOf(".") + 1)) > -1)//查找.txt .aspx结尾的文件
                    if (Filetype.IndexOf(file.Substring(file.LastIndexOf(".") + )) > -)//如果后缀名为.txt文件
                    {
                        FileInfo fi = new FileInfo(file);//建立FileInfo对象
                        alst.Add(fi.FullName);//把.txt文件全名加人到FileInfo对象

                        //if (File.Exists(fi.FullName))
                        //{
                        //    File.Delete(fi.FullName);
                        //}
                    }
                }
            }
            catch
            {

            }
        }
        /// <summary>
        /// 获取CSS文件
        /// </summary>
        /// <param name="dir"></param>
        public static void GetFiles(string dir)
        {
            try
            {
                string[] files = Directory.GetFiles(dir);//得到文件
                foreach (string file in files)//循环文件
                {
                    string exname = file.Substring(file.LastIndexOf(".") + );//得到后缀名
                    // if (".txt|.aspx".IndexOf(file.Substring(file.LastIndexOf(".") + 1)) > -1)//查找.txt .aspx结尾的文件
                    if (".css".IndexOf(file.Substring(file.LastIndexOf(".") + )) > -)//如果后缀名为.txt文件
                    {
                        FileInfo fi = new FileInfo(file);//建立FileInfo对象
                        alst.Add(fi.FullName);//把.txt文件全名加人到FileInfo对象

                        //if (File.Exists(fi.FullName))
                        //{
                        //    File.Delete(fi.FullName);
                        //}
                    }
                }
            }
            catch
            {

            }
        }
        public static string[] readlist(string path)
        {
            alst = new System.Collections.ArrayList();//建立ArrayList对象
            GetDirs(path);//得到文件夹
            return (string[])alst.ToArray(typeof(string));//把ArrayList转化为string[]
        }

        public static void GetDirs(string d)//得到所有文件夹
        {
            GetFiles(d);//得到所有文件夹里面的文件
            try
            {
                string[] dirs = Directory.GetDirectories(d);
                foreach (string dir in dirs)
                {
                    GetDirs(dir);//递归
                }
            }
            catch
            {
            }
        }
        #endregion

5、C#时间处理

#region 时间处理
        /// <summary>
        /// 用于统计时间段内的天数
        /// </summary>
        /// <param name="DateTime1">时间一</param>
        /// <param name="DateTime2">时间二</param>
        /// <returns></returns>
        public static int DayDiff(DateTime DateTime1, DateTime DateTime2)
        {
            TimeSpan ts1 = new TimeSpan(DateTime1.Ticks);
            TimeSpan ts2 = new TimeSpan(DateTime2.Ticks);
            TimeSpan ts = ts1.Subtract(ts2).Duration();
            return ts.Days;
        }

        public static int MinutesDiff(DateTime DateTime1, DateTime DateTime2)
        {
            TimeSpan ts1 = new TimeSpan(DateTime1.Ticks);
            TimeSpan ts2 = new TimeSpan(DateTime2.Ticks);
            TimeSpan ts = ts1.Subtract(ts2).Duration();
            return ts.Minutes;
        }

        /// <summary>
        /// 时间一减去时间二
        /// </summary>
        /// <param name="DateTime1">时间一</param>
        /// <param name="DateTime2">时间二</param>
        /// <returns></returns>
        public static int DiffDay(DateTime DateTime1, DateTime DateTime2)
        {
            TimeSpan ts1 = new TimeSpan(DateTime1.Ticks);
            TimeSpan ts2 = new TimeSpan(DateTime2.Ticks);
            TimeSpan ts = ts1.Subtract(ts2);
            return ts.Days;
        }

        /// <summary>
        /// 时间格式转换
        /// </summary>
        /// <param name="dt">时间</param>
        /// <returns>特定时间格式</returns>
        public static string GetDateFomatString(DateTime dt)
        {
            return string.Format("{0:yy年MM月dd日HH时mm分}", dt);
        }
        public static string GetDateFomatString()
        {
            return string.Format("{0:yy年MM月dd日HH时mm分}", DateTime.Now);
        }
        public static string GetDateFomatAllString(DateTime dt)
        {
            return string.Format("{0:yyyy-MM-dd HH:mm:ss}", dt);
        }
        public static string GetDateFomatAllString(object dt)
        {
            return string.Format("{0:yyyy-MM-dd HH:mm:ss}", dt);
        }
        public static string GetDateFomatStringSimple(object dt)
        {
            return string.Format("{0:yyyy-MM-dd}", dt);
        }
        #endregion

 @陈卧龙的博客