一套基于asp.net的安全校验机制应用模型 ！

using System;
using System.Data;
using System.Configuration;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;

using System.IO;
using System.Text;
using System.Web.UI.MobileControls;
using System.Collections.Generic;

/// <summary>
///SQLFilter 的摘要说明
/// </summary>
public static class SQLFilter
{

#region SQL注入过滤
/// <summary>
/// SQL注入过滤
/// </summary>
/// <param name="sqlParems">要过滤的参数数组</param>
/// <returns>如果参数存在不安全字符，则返回false</returns>

// 应用示例
// if(TheManagerUtils.SqlFilter(new string[] { "ss","kk" }, this.Page) == false)
// {
//     //直接跳转到相应的错误页面
//     Response.Redirect("WelfarePage.aspx");
//     return;
// }
public static bool SqlFilter(string[] sqlParems, Page p)
{
StringBuilder parems = new StringBuilder();

#region 有关非法数据的相关维护
//常用的SQL恶意字符屏蔽
string sql = "insert|delete|update|select|exec|script";
try
{
//获取配置在Web.config中最新的SQL恶意字符屏蔽
sql = System.Configuration.ConfigurationSettings.AppSettings["SQLFilter"].ToString();
}
catch (Exception)
{
//对于配置文件的错误配置，将采用常用的SQL恶意字符屏蔽
sql = "insert|delete|update|select|exec|script";
}
#endregion

#region sqlParems数组参数的合法校验
foreach (string var in SetAllsqlParems(sqlParems,p))
{
foreach (string i in sql.Split('|'))
{
if (var.IndexOf(i.ToLower()) > -1)
{
try
{
using (FileStream file = new FileStream(System.Web.HttpContext.Current.Server.MapPath("~//" + DateTime.Now.ToString("yyyy年MM月dd日") + "非法数据记录.txt"), FileMode.Append))
{
StreamWriter sw = new StreamWriter(file);

foreach (string value in SetAllsqlParems(sqlParems, p))
{
parems.Append(" [" + value + "] ");
}
//p.RegisterStartupScript("", "<mce:script type="text/javascript"><!--
alert('尊敬的非法用户："+p.User.Identity.Name+",您的IP："+p.Request.UserHostAddress+" 进行的非法操作已经记录 ！');
// --></mce:script>");
//sw.WriteLine(DateTime.Now.ToString("HH:mm:ss") + "  用户：[" + p.User.Identity.Name + "：" + p.Request.UserHostAddress + "]    原始URL：[" + p.Request.Url + "]   非法字符：[" + var + ":" + i + "]   全部参数：" + parems.ToString());

sw.WriteLine(DateTime.Now.ToString("HH:mm:ss") + "  IP：[" + p.Request.UserHostAddress + "]    原始URL：[" + p.Request.Url + "]   非法字符：[" + var + "：" + i + "]   全部参数：" + parems.ToString());
sw.WriteLine();

sw.Close();
file.Close();
}
}
catch (Exception) { }
return false;
}
}
}
#endregion

return true;
}
#endregion

#region 需要校验的数据集合整理
public static string[] SetAllsqlParems(string[] sqlParems, Page p)
{
List<string> list = new List<string>();

if (sqlParems != null)
{
foreach (string var in sqlParems)
{
if (var == null || var.Equals(""))
{}
else
{
list.Add(var.Trim().ToLower());
}
}
}

foreach (Control var in p.Form.Controls)
{
if (var.GetType() == typeof(System.Web.UI.WebControls.TextBox))
{
string text = ((System.Web.UI.WebControls.TextBox)var).Text.Trim().ToLower();
if (text == null || text.Equals(""))
{}
else
{
list.Add(text);
}
}
}

return list.ToArray();
}
#endregion

}