C# 过滤sql特殊字符串方法

/// <summary>
    /// 过滤不安全的字符串
    /// </summary>
    /// <param name="Str"></param>
    /// <returns></returns>
    public static string FilteSQLStr(string Str)
    {

Str = Str.Replace("'", "");
        Str = Str.Replace("\"", "");
        Str = Str.Replace("&", "&amp");
        Str = Str.Replace("<", "&lt");
        Str = Str.Replace(">", "&gt");

Str = Str.Replace("delete", "");
Str = Str.Replace("update", "");
Str = Str.Replace("insert", "");

return Str;
}

#region 过滤 Sql 语句字符串中的注入脚本
        /// <summary>
        /// 过滤 Sql 语句字符串中的注入脚本
        /// </summary>
        /// <param name="source">传入的字符串</param>
        /// <returns>过滤后的字符串</returns>
        public static string SqlFilter(string source)
        {
            //单引号替换成两个单引号
            source = source.Replace("'", "''");

//半角封号替换为全角封号，防止多语句执行
source = source.Replace(";", "；");

//半角括号替换为全角括号
source = source.Replace("(", "（");
source = source.Replace(")", "）");

///////////////要用正则表达式替换，防止字母大小写得情况////////////////////

//去除执行存储过程的命令关键字
source = source.Replace("Exec", "");
source = source.Replace("Execute", "");

//去除系统存储过程或扩展存储过程关键字
source = source.Replace("xp_", "x p_");
source = source.Replace("sp_", "s p_");

//防止16进制注入
source = source.Replace("0x", "0 x");

return source;
}
#endregion

/// 过滤SQL字符。
        /// </summary>
        /// <param name="str">要过滤SQL字符的字符串。</param>
        /// <returns>已过滤掉SQL字符的字符串。</returns>
        public static string ReplaceSQLChar(string str)
        {
            if (str == String.Empty)
                return String.Empty; str = str.Replace("'", "‘");
            str = str.Replace(";", "；");
            str = str.Replace(",", ",");
            str = str.Replace("?", "?");
            str = str.Replace("<", "＜");
            str = str.Replace(">", "＞");
            str = str.Replace("(", "(");
            str = str.Replace(")", ")");
            str = str.Replace("@", "＠");
            str = str.Replace("=", "＝");
            str = str.Replace("+", "＋");
            str = str.Replace("*", "＊");
            str = str.Replace("&", "＆");
            str = str.Replace("#", "＃");
            str = str.Replace("%", "％");
            str = str.Replace("$", "￥");

return str;
}

/// <summary>
/// 过滤标记
/// </summary>
/// <param name="NoHTML">包括HTML，脚本，数据库关键字，特殊字符的源码 </param>
/// <returns>已经去除标记后的文字</returns>
public string NoHtml(string Htmlstring)
{
    if (Htmlstring == null)
    {
        return "";
    }
    else
    {
        //删除脚本
         Htmlstring = Regex.Replace(Htmlstring, @"<script[^>]*?>.*?</script>", "", RegexOptions.IgnoreCase);
        //删除HTML
        Htmlstring = Regex.Replace(Htmlstring, @"<(.[^>]*)>", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"([\r\n])[\s]+", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"-->", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"<!--.*", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(quot|#34);", "\"", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(amp|#38);", "&", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(lt|#60);", "<", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(gt|#62);", ">", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(nbsp|#160);", " ", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(iexcl|#161);", "\xa1", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(cent|#162);", "\xa2", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(pound|#163);", "\xa3", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&(copy|#169);", "\xa9", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @"&#(\d+);", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "xp_cmdshell", "", RegexOptions.IgnoreCase);

//删除与数据库相关的词
         Htmlstring = Regex.Replace(Htmlstring, "select", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "insert", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "delete from", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "count''", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "drop table", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "truncate", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "asc", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "mid", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "char", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "xp_cmdshell", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "exec master", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "net localgroup administrators", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "and", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "net user", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "or", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "net", "", RegexOptions.IgnoreCase);
        //Htmlstring = Regex.Replace(Htmlstring, "*", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "-", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "delete", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "drop", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, "script", "", RegexOptions.IgnoreCase);

//特殊的字符
         Htmlstring = Htmlstring.Replace("<", "");
        Htmlstring = Htmlstring.Replace(">", "");
        Htmlstring = Htmlstring.Replace("*", "");
        Htmlstring = Htmlstring.Replace("-", "");
        Htmlstring = Htmlstring.Replace("?", "");
        Htmlstring = Htmlstring.Replace("'", "''");
        Htmlstring = Htmlstring.Replace(",", "");
        Htmlstring = Htmlstring.Replace("/", "");
        Htmlstring = Htmlstring.Replace(";", "");
        Htmlstring = Htmlstring.Replace("*/", "");
        Htmlstring = Htmlstring.Replace("\r\n", "");
        Htmlstring = HttpContext.Current.Server.HtmlEncode(Htmlstring).Trim();

return Htmlstring;
}
}

public static bool CheckBadWord(string str)
{
string pattern = @"select|insert|delete|from|count\(|drop table|update|truncate|asc\(|mid\(|char\(|xp_cmdshell|exec master|netlocalgroup administrators|net user|or|and";
if (Regex.IsMatch(str, pattern, RegexOptions.IgnoreCase))
return true;
return false;
}
public static string Filter(string str)
{
string[] pattern ={ "select", "insert", "delete", "from", "count\\(", "drop table", "update","truncate", "asc\\(", "mid\\(", "char\\(", "xp_cmdshell", "exec master", "netlocalgroup administrators", "net user", "or", "and" };
for (int i = 0; i < pattern.Length; i++)
{
str = str.Replace(pattern[i].ToString(), "");
}
return str;
}

SQL字符串过滤函数：

public static bool ProcessSqlStr(string Str)

{

bool ReturnValue = true;

try

{

if (Str.Trim() != "")

{

string SqlStr =

"exec|insert+|select+|delete|update|count|chr|mid|master+|truncate|char|declare|drop+|drop+table|creat+|create|*|iframe|script|"

;

SqlStr +=

"exec+|insert|delete+|update+|count(|count+|chr+|+mid(|+mid+|+master+|truncate+|char+|+char(|declare+|drop+table|creat+table"

;

string[] anySqlStr = SqlStr.Split('|');

foreach (string ss in anySqlStr)

{

if (Str.ToLower().IndexOf(ss) >= 0)

{

ReturnValue = false;

break;

}

catch

{

ReturnValue = false;

}

return ReturnValue;

}

C# 过滤sql特殊字符串方法的更多相关文章

Sql分隔字符串方法--split
SET ANSI_NULLS ON GO SET QUOTED_IDENTIFIER ON GO --DEClARE @str varchar(500)='a,b2,v5,d3,ew,2,3,dd' ...
过滤sql特殊字符方法集合
/// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str" ...
C# 过滤sql特殊字符方法集合
1./// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str" ...
.net 过滤 sql防注入类，省地以后每次都要重新弄！
/// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str"&g ...
输入值/表单提交参数过滤有效防止sql注入的方法
输入值/表单提交参数过滤,防止sql注入或非法攻击的方法: 代码如下: /** * 过滤sql与php文件操作的关键字 * @param string $string * @return strin ...
在php中防止SQL注入的方法
摘要:我们php手手工安装的,php的默认配置文件在 /usr/local/apache2/conf/php.ini,我们最主要就是要配置php.ini中的内容,让我们执行 php能够更安全.整个PH ...
Python中防止sql注入的方法详解
SQL注入是比较常见的网络攻击方式之一,它不是利用操作系统的BUG来实现攻击,而是针对程序员编程时的疏忽,通过SQL语句,实现无帐号登录,甚至篡改数据库.下面这篇文章主要给大家介绍了关于Python中 ...
.Net防sql注入的方法总结
#防sql注入的常用方法: 1.服务端对前端传过来的参数值进行类型验证: 2.服务端执行sql,使用参数化传值,而不要使用sql字符串拼接: 3.服务端对前端传过来的数据进行sql关键词过来与检测: ...
PHP+Mysql防止SQL注入的方法
这篇文章介绍的内容是关于PHP+Mysql防止SQL注入的方法,有着一定的参考价值,现在分享给大家,有需要的朋友可以参考一下方法一: mysql_real_escape_string -- 转义 S ...

随机推荐

UWP开发入门（四）——自定义CommandBar
各位好,再次回到UWP开发入门系列,刚回归可能有些不适应,所以今天我们讲个简单的,自定义CommandBar,说通俗点就是自定义类似AppBarButton的东西,然后扔到CommandBar中使用. ...
学习迭代器实现C#异步编程——仿async/await（一）
.NET 4.5的async/await真是个神奇的东西,巧妙异常以致我不禁对其实现充满好奇,但一直难以窥探其门径.不意间读了此篇强文<Asynchronous Programming in C ...
SparkSQL大数据实战：揭开Join的神秘面纱
本文来自网易云社区 . Join操作是数据库和大数据计算中的高级特性,大多数场景都需要进行复杂的Join操作,本文从原理层面介绍了SparkSQL支持的常见Join算法及其适用场景. Join背景介 ...
474. Ones and Zeroes
In the computer world, use restricted resource you have to generate maximum benefit is what we alway ...
java中继承的关系
当有父子关系的两个类(继承关系),当子类实例化对象的时候会默认调用父类的无参构造方法,如果有 super()的话,调用的是父类有参的构造方法! 也就是说父类必须有有参构造没有的话super ...
sonarLint和sonarQube
在线安装和离线装sonarLint https://blog.csdn.net/limm33/article/details/51166840 下载指定版本的sonarLint https://bin ...
eclipse如何汉化，把eclipse改成中文版
eclipse默认是英文版的,对于中国人来说使用英文语言的软件是件痛苦的事情.下面我来详细说一下如何把eclipse改成中文版的. 工具/原料 eclipse英文版 eclipse中文插件方法/ ...
[转载] 解决gns3 for mac模拟器三层交换机无法成功创建vlan的问题
1.删除之前导入的ios: 2.选择GNS3--Edit--Preferences--IOS routers--New--导入ios-- 勾选This is an EtherSwitch router ...
python unittest框架理解与总结（二）
unittest基本原理: ♦整个平台的搭建使用的是python的unittest测试框架,这里简单介绍下unittest模块的简单应用. ♦unittest是python的标准测试库,相比于其他测试 ...
【ASP.NET】DataTable导出EXCEL,弹窗提示下载保存（完整代码）
//新建ASPX protected void Page_Load(object sender, EventArgs e) { DataTable dt = new DataTable(); Data ...

C# 过滤sql特殊字符串方法

C# 过滤sql特殊字符串方法的更多相关文章

随机推荐

热门专题