SQL防漏洞注入攻击小结

3
78
79
80
81#region 转换sql代码（也防止sql注入式攻击，可以用于业务逻辑层，但要求UI层输入数据时候进行解码）
82///
83/// 提取字符固定长度
84///
85///
86///
87///
88public string CheckStringLength(string inputString, Int32 maxLength)
89{
90 if ((inputString != null) && (inputString != String.Empty))
91 {
92 inputString = inputString.Trim();
93
94 if (inputString.Length > maxLength)
95 inputString = inputString.Substring(0, maxLength);
96 }
97 return inputString;
98}
99
100///
101/// 将输入字符串中的sql敏感字，替换成"[敏感字]"，要求输出时，替换回来
102///
103///
104///
105public string MyEncodeInputString(string inputString)
106{
107 //要替换的敏感字
108 string SqlStr = @"and|or|exec|execute|insert|select|delete|update|alter|create|drop|count|\*|chr|char|asc|mid|substring|master|truncate|declare|xp_cmdshell|restore|backup|net +user|net +localgroup +administrators";
109 try
110 {
111 if ((inputString != null) && (inputString != String.Empty))
112 {
113 string str_Regex = @"\b(" + SqlStr + @")\b";
114
115 Regex Regex = new Regex(str_Regex, RegexOptions.IgnoreCase);
116 //string s = Regex.Match(inputString).Value;
117 MatchCollection matches = Regex.Matches(inputString);
118 for (int i = 0; i < matches.Count; i++)
119 inputString = inputString.Replace(matches[i].Value, "[" + matches[i].Value + "]");
120
121 }
122 }
123 catch
124 {
125 return "";
126 }
127 return inputString;
128
129}
130
131///
132/// 将已经替换成的"[敏感字]"，转换回来为"敏感字"
133///
134///
135///
136public string MyDecodeOutputString(string outputstring)
137{
138 //要替换的敏感字
139 string SqlStr = @"and|or|exec|execute|insert|select|delete|update|alter|create|drop|count|\*|chr|char|asc|mid|substring|master|truncate|declare|xp_cmdshell|restore|backup|net +user|net +localgroup +administrators";
140 try
141 {
142 if ((outputstring != null) && (outputstring != String.Empty))
143 {
144 string str_Regex = @"\[\b(" + SqlStr + @")\b\]";
145 Regex Regex = new Regex(str_Regex, RegexOptions.IgnoreCase);
146 MatchCollection matches = Regex.Matches(outputstring);
147 for (int i = 0; i < matches.Count; i++)
148 outputstring = outputstring.Replace(matches[i].Value, matches[i].Value.Substring(1, matches[i].Value.Length - 2));
149
150 }
151 }
152 catch
153 {
154 return "";
155 }
156 return outputstring;
157}