过滤器，但是asp.net 提交时候怎么过滤form里的具体值呢，大部分提交又不是访问页，已经解决

using System;  
using System.Data;  
using System.Configuration;  
using System.Web;  
using System.Web.Security;  
using System.Web.UI;  
using System.Web.UI.HtmlControls;  
using System.Web.UI.WebControls;  
using System.Web.UI.WebControls.WebParts;  
 
/// <summary>  
///cedar 的摘要说明  
/// </summary>  
public class cedar:IHttpModule  
{  
    public cedar()  
    {  
        //  
        //TODO: 在此处添加构造函数逻辑  
        //  
    }  
    public void Dispose()  
    {  
 
    }  
 
    public void Init(HttpApplication application)  
    {  
        application.AcquireRequestState += new EventHandler(application_AcquireRequestState);  
    }  
    private void application_AcquireRequestState(object sender, EventArgs e)  
    {  
        HttpContext content = ((HttpApplication)sender).Context;  
        try 
        {  
            string sqlErrorPage = "default.html";//转到默认页面  
            string keyValue = string.Empty;  
            string requestUrl = content.Request.Path.ToString();  
            if (content.Request.QueryString != null)  
            {  
                foreach (string val in content.Request.QueryString)  
                {  
                   keyValue= content.Server.UrlDecode(content.Request.QueryString[val]);  
                   if (!processSqlStr(keyValue))  
                   {  
                       content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。<br><a href=""+sqlErrorPage+"" mce_href=""+sqlErrorPage+"">转到首页</a>");  
                       content.Response.End();  
                       break;  
                   }  
                }  
            }  
            if (content.Request.Form != null)  
            {  
                foreach(string val in content.Request.Form)  
                {  
                    keyValue = content.Server.HtmlDecode(content.Request.Form[val]);  
                    if (keyValue == "_ViEWSTATE") continue;  
                    if (!processSqlStr(keyValue))  
                    {  
                        content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。");  
                        content.Response.End();  
                        break;  
                    }  
                }  
            }  
        }  
        catch (Exception ex)  
        {  
        }  
    }  
    private bool processSqlStr(string str)  
    {  
        bool returnValue = true;  
        try 
        {  
            if (str.Trim() != "")  
            {  
                //取得webconfig中过滤字符串  
                string sqlStr = ConfigurationManager.AppSettings["FilterSql"].Trim();  
                //string sqlStr = "declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate";  
                string[] sqlStrs = sqlStr.Split('|');  
                foreach (string ss in sqlStrs)  
                {  
                    if (str.ToLower().IndexOf(ss) >= 0)  
                    {  
                        sqlStr = ss;  
                        returnValue = false;  
                        break;  
                    }  
                }  
            }  
        }  
        catch 
        {  
            returnValue = false;  
        }  
        return returnValue;  
    }  
} 
using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;

/// <summary>
///cedar 的摘要说明
/// </summary>
public class cedar:IHttpModule
{
 public cedar()
 {
  //
  //TODO: 在此处添加构造函数逻辑
  //
 }
    public void Dispose()
    {

    }

    public void Init(HttpApplication application)
    {
        application.AcquireRequestState += new EventHandler(application_AcquireRequestState);
    }
    private void application_AcquireRequestState(object sender, EventArgs e)
    {
        HttpContext content = ((HttpApplication)sender).Context;
        try
        {
            string sqlErrorPage = "default.html";//转到默认页面
            string keyValue = string.Empty;
            string requestUrl = content.Request.Path.ToString();
            if (content.Request.QueryString != null)
            {
                foreach (string val in content.Request.QueryString)
                {
                   keyValue= content.Server.UrlDecode(content.Request.QueryString[val]);
                   if (!processSqlStr(keyValue))
                   {
                       content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。<br><a href=""+sqlErrorPage+"" mce_href=""+sqlErrorPage+"">转到首页</a>");
                       content.Response.End();
                       break;
                   }
                }
            }
            if (content.Request.Form != null)
            {
                foreach(string val in content.Request.Form)
                {
                    keyValue = content.Server.HtmlDecode(content.Request.Form[val]);
                    if (keyValue == "_ViEWSTATE") continue;
                    if (!processSqlStr(keyValue))
                    {
                        content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。");
                        content.Response.End();
                        break;
                    }
                }
            }
        }
        catch (Exception ex)
        {
        }
    }
    private bool processSqlStr(string str)
    {
        bool returnValue = true;
        try
        {
            if (str.Trim() != "")
            {
                //取得webconfig中过滤字符串
                string sqlStr = ConfigurationManager.AppSettings["FilterSql"].Trim();
                //string sqlStr = "declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate";
                string[] sqlStrs = sqlStr.Split('|');
                foreach (string ss in sqlStrs)
                {
                    if (str.ToLower().IndexOf(ss) >= 0)
                    {
                        sqlStr = ss;
                        returnValue = false;
                        break;
                    }
                }
            }
        }
        catch
        {
            returnValue = false;
        }
        return returnValue;
    }
}
 

在web.config中添加以下：

<appSettings>
  <add key="FilterSql" value="declare |exec|varchar |cursor |begin |open |drop |creat |select |truncate "/>
 </appSettings>

<httpModules>
   <add type="cedar" name="cedar"/>
  </httpModules>

 

 

 

 

 

已经解决

private void Application_AcquireRequestState(Object source,
        EventArgs e)
    {
        HttpApplication application = (HttpApplication)source;
        HttpContext context = application.Context;
        HttpSessionState session = context.Session;
        HttpRequest request = context.Request;
        HttpResponse response = context.Response;
        String contextPath = request.ApplicationPath;
        //session["admin"] = "sdfsdfsdfsdf";
        for (int i = 0; i < request.Form.Count; i++)
        {
            if (request.Form[i].ToString() == "__VIEWSTATE") continue;
            if (IsM(request.Form[i].ToString()))
            {
                response.Write("您提交的内容中含有非法字符.");
                response.End();
            }

        } 

        //string keyValue = String.Empty;
        //if (context.Request.QueryString != null)
        //{
        //    foreach (string val in context.Request.QueryString)
        //    {
        //        keyValue = context.Server.UrlDecode(context.Request.QueryString[val]);
        //        //keyValue=keyValue.Replace("aa", "bb");
        //        keyValue = processStr(keyValue);
        //        //if (!processSqlStr(keyValue))  
        //        //{  
        //        //    content.Response.Write("您访问的页面发生错误，此问题我们已经记录并尽快改善，请稍后再试。<br><a href=""+sqlErrorPage+"" mce_href=""+sqlErrorPage+"">转到首页</a>");  
        //        //    content.Response.End();  
        //        //    break;  
        //        //}  
        //        context.Response.Write("" + keyValue + "");
        //        context.Response.End();
        //        break;

        //    }
        //}
    }