过滤网址和输入框中的特殊字符，防止sql注入（C#版）

防sql注入不必在每个页面都写验证了，下面方面便可以一劳永逸。

using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;

/// <summary>
///cedar 的摘要说明
/// </summary>
public class cedar:IHttpModule
{
public cedar()
{
//
//TODO: 在此处添加构造函数逻辑
//
}
public void Dispose()
{

}

public void Init(HttpApplication application)
{
application.AcquireRequestState += new EventHandler(application_AcquireRequestState);
}
private void application_AcquireRequestState(object sender, EventArgs e)
{
HttpContext content = ((HttpApplication)sender).Context;
try
{
string sqlErrorPage = "default.html";//转到默认页面
string keyValue = string.Empty;
string requestUrl = content.Request.Path.ToString();
if (content.Request.QueryString != null)
{
foreach (string val in content.Request.QueryString)
{
keyValue= content.Server.UrlDecode(content.Request.QueryString[val]);
if (!processSqlStr(keyValue))
{
content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。<br><a href=""+sqlErrorPage+"" mce_href=""+sqlErrorPage+"">转到首页</a>");
content.Response.End();
break;
}
}
}
if (content.Request.Form != null)
{
foreach(string val in content.Request.Form)
{
keyValue = content.Server.HtmlDecode(content.Request.Form[val]);
if (keyValue == "_ViEWSTATE") continue;
if (!processSqlStr(keyValue))
{
content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。");
content.Response.End();
break;
}
}
}
}
catch (Exception ex)
{
}
}
private bool processSqlStr(string str)
{
bool returnValue = true;
try
{
if (str.Trim() != "")
{
//取得webconfig中过滤字符串
string sqlStr = ConfigurationManager.AppSettings["FilterSql"].Trim();
//string sqlStr = "declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate";
string[] sqlStrs = sqlStr.Split('|');
foreach (string ss in sqlStrs)
{
if (str.ToLower().IndexOf(ss) >= 0)
{
sqlStr = ss;
returnValue = false;
break;
}
}
}
}
catch
{
returnValue = false;
}
return returnValue;
}
}

在web.config中添加以下：

<appSettings>
<add key="FilterSql" value="declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate "/>
</appSettings>

<httpModules>
<add type="cedar" name="cedar"/>
</httpModules>