过滤sql特殊字符方法集合
/// <summary>
/// 过滤不安全的字符串
/// </summary>
/// <param name="Str"></param>
/// <returns></returns>
public static string FilteSQLStr( string Str)
{
Str = Str.Replace( " ' " , "" );
Str = Str.Replace( " /" " , "" );
Str = Str.Replace( " & " , " & " );
Str = Str.Replace( " < " , " < " );
Str = Str.Replace( " > " , " > " );
Str = Str.Replace( " delete " , "" );
Str = Str.Replace( " update " , "" );
Str = Str.Replace( " insert " , "" );
return Str;
}
2.
#region 过滤 Sql 语句字符串中的注入脚本
/// <summary>
/// 过滤 Sql 语句字符串中的注入脚本
/// </summary>
/// <param name="source"> 传入的字符串 </param>
/// <returns> 过 滤后的字符串 </returns>
public static string SqlFilter( string source)
{
// 单引号替换成两个单引号
source = source.Replace( " ' " , " '' " );
// 半角封号替换为全角封号，防止多语句执行
source = source.Replace( " ; " , " ； " );
// 半角括号替换为全角括号
source = source.Replace( " ( " , " （ " );
source = source.Replace( " ) " , " ） " );
/////////////// 要用正则表达式替换，防止字母大小写得情况 ////////////////// //
// 去除执行存储过程的命令关键字
source = source.Replace( " Exec " , "" );
source = source.Replace( " Execute " , "" );
// 去除系统存储过程或扩展存储过程关键字
source = source.Replace( " xp_ " , " x p_ " );
source = source.Replace( " sp_ " , " s p_ " );
// 防止16进制注入
source = source.Replace( " 0x " , " 0 x " );
return source;
}
#endregion
3.
/// 过滤SQL字符。
/// </summary>
/// <param name="str"> 要过滤SQL字符的字符串。 </param>
/// <returns> 已过滤掉SQL字符的字符串。 </returns>
public static string ReplaceSQLChar( string str)
{
if (str == String.Empty)
return String.Empty; str = str.Replace( " ' " , " ‘ " );
str = str.Replace( " ; " , " ； " );
str = str.Replace( " , " , " , " );
str = str.Replace( " ? " , " ? " );
str = str.Replace( " < " , " ＜ " );
str = str.Replace( " > " , " ＞ " );
str = str.Replace( " ( " , " ( " );
str = str.Replace( " ) " , " ) " );
str = str.Replace( " @ " , " ＠ " );
str = str.Replace( " = " , " ＝ " );
str = str.Replace( " + " , " ＋ " );
str = str.Replace( " * " , " ＊ " );
str = str.Replace( " & " , " ＆ " );
str = str.Replace( " # " , " ＃ " );
str = str.Replace( " % " , " ％ " );
str = str.Replace( " $ " , " ￥ " );
return str;
}
4.
/// <summary>
/// 过滤标记
/// </summary>
/// <param name="NoHTML"> 包括HTML，脚本，数据库关键字，特殊字符的源码 </param>
/// <returns> 已经去除标记后的文字 </returns>
public string NoHtml( string Htmlstring)
{
if (Htmlstring == null )
{
return "" ;
}
else
{
// 删除脚本
Htmlstring = Regex.Replace(Htmlstring, @" <script[^>]*?>.*?</script> " , "" , RegexOptions.IgnoreCase);
// 删除HTML
Htmlstring = Regex.Replace(Htmlstring, @" <(.[^>]*)> " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" ([/r/n])[/s]+ " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" --> " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" <!--.* " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(quot|#34); " , " /" " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(amp|#38); " , " & " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(lt|#60); " , " < " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(gt|#62); " , " > " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(nbsp|#160); " , " " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(iexcl|#161); " , " /xa1 " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(cent|#162); " , " /xa2 " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(pound|#163); " , " /xa3 " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &(copy|#169); " , " /xa9 " , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, @" &#(/d+); " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " xp_cmdshell " , "" , RegexOptions.IgnoreCase);
// 删除与数据库相关的词
Htmlstring = Regex.Replace(Htmlstring, " select " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " insert " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " delete from " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " count'' " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " drop table " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " truncate " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " asc " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " mid " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " char " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " xp_cmdshell " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " exec master " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " net localgroup administrators " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " and " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " net user " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " or " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " net " , "" , RegexOptions.IgnoreCase);
// Htmlstring = Regex.Replace(Htmlstring, "*", "", RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " - " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " delete " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " drop " , "" , RegexOptions.IgnoreCase);
Htmlstring = Regex.Replace(Htmlstring, " script " , "" , RegexOptions.IgnoreCase);
// 特殊的字符
Htmlstring = Htmlstring.Replace( " < " , "" );
Htmlstring = Htmlstring.Replace( " > " , "" );
Htmlstring = Htmlstring.Replace( " * " , "" );
Htmlstring = Htmlstring.Replace( " - " , "" );
Htmlstring = Htmlstring.Replace( " ? " , "" );
Htmlstring = Htmlstring.Replace( " ' " , " '' " );
Htmlstring = Htmlstring.Replace( " , " , "" );
Htmlstring = Htmlstring.Replace( " / " , "" );
Htmlstring = Htmlstring.Replace( " ; " , "" );
Htmlstring = Htmlstring.Replace( " */ " , "" );
Htmlstring = Htmlstring.Replace( " /r/n " , "" );
Htmlstring = HttpContext.Current.Server.HtmlEncode(Htmlstring).Trim();
return Htmlstring;
}
}
5.
; i < pattern.Length; i ++ )
{
str = str.Replace(pattern[i].ToString(), "" );
}
return str;
}
过滤sql特殊字符方法集合的更多相关文章
- C# 过滤sql特殊字符方法集合
1./// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str" ...
- mssql sql语句过滤百分号的方法分享
转自:http://www.maomao365.com/?p=6743 摘要: 下文讲述sql脚本中过滤百分号的方法: 实验环境:sql server 2008 R2 百分号:在sql脚本编写中“百 ...
- C# 过滤sql特殊字符串方法
1. /// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str" ...
- jQuery过滤选择器:not()方法使用介绍
在jQuery的早期版本中,:not()筛选器只支持简单的选择器,说明我们传入到:not这个filter中的selector可以任意复杂,比如:not(div a) and :not(div,a) & ...
- SQL特殊字符转义
原文链接: SQL特殊字符转义 应 该说,您即使没有处理 HTML 或 JavaScript 的特殊字符,也不会带来灾难性的后果,但是如果不在动态构造 SQL 语句时对变量中特殊字符进行处理,将可能导 ...
- TP5：使用了INPUT函数来接收参数了，还需再过滤SQL注入吗
TP5:使用了INPUT函数来接收参数了,还需再过滤SQL注入吗,默认的INPUT函数都做了哪些动作啊 有了PDO参数绑定 基本上不需要考虑sql注入的问题(除非自己拼接SQL),需要考虑的是XSS方 ...
- jQuery过滤选择器:not()方法介绍
jQuery(':not(selector)') 在jQuery的早期版本中,:not()筛选器只支持简单的选择器,说明我们传入到:not这个filter中的selector可以任意复杂,比如:not ...
- .net 过滤 sql防注入类，省地以后每次都要重新弄！
/// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str"&g ...
- 5.用通配符进行过滤 ---SQL
一.LIKE操作符 通配符(wildcard) 用来匹配值的一部分的特殊字符.搜索模式(search pattern)由字面值.通配符或两者组合构成的搜索条件.通配符本身实际上是SQL的WHERE子句 ...
随机推荐
- Python学习笔记_week3_函数
一.介绍 1.面向对象(华山派)--->类(独门秘籍)--->class(定义的关键字) 2.面向过程(少林派)--->过程--->def 3.函数式编程(逍遥派)---> ...
- 【ASP.NET 进阶】判断访问网站的客户端是PC还是手机
主要就是通过客户端传递的User-agent来判断访问网站的客户端是PC还是手机,.NET中就是Request.ServerVariables["HTTP_USER_AGENT"] ...
- template.js 数据渲染引擎
template.js 数据渲染引擎 template.js是一款JavaScript模板引擎,用来渲染页面的. 原理:提前将Html代码放进编写模板 <script id="tpl& ...
- PerformCallback(珍藏版)
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="PerformCallback. ...
- <基础> PHP 进阶之 函数（Function）
引用参数 $name = "eko"; function chang_name(&$name){ $name .= '_after_change'; } chang_nam ...
- day18-列表生成式、迭代器
1.列表生成式,也叫列表推导式 即List Comprehensions,是Python内置的非常简单却强大的可以用来创建list的生成式.优点:构造简单,一行完成缺点:不能排错,不能构建复杂的数据结 ...
- Spring boot 日志
修改spring boot 默认日志的配置 #logging.path= # 不指定路径在当前项目下生成springboot.log日志 # 可以指定完整的路径: #logging.file=G:/s ...
- Django--ORM(模型层)--多表(重重点)
一.数据库表关系 单表 重复的字段太多,所以需要一对多,多对多来简化 多表 多对一 多对多 一对一 =============================================== 一对 ...
- js 提示框的实现---组件开发之（二）
接着第上一个,在js文件里再增加一个 popModal 模块,实现弹框效果 css 代码: .alert { padding: 15px; margin-bottom: 20px; border: 1 ...
- 在Linux中简单实现回收子进程
学习到wait函数了,这个函数的作用是用来回收进程.一般来说,正常退出的进程是不需要我们来专门回收的.但是进程有这两种:孤儿进程和僵尸进程. 孤儿进程: 通俗点说就是父进程先于子进程死亡.此时子进程就 ...