过滤危险字符函数代码防SQL注入代码,Asp.Net代码库,德仔网

代码语言
代码分类
【Asp.Net】过滤危险字符函数代码防SQL注入
作者:Dezai.CN / 发布于2012/2/20/ 1068
<div>sing System; 
sing System.Collections.Generic; 
sing System.Linq; 
sing System.Text; 
sing System.Text.RegularExpressions; 
amespace BIReportCenter.Utility 

ublic class StringHelper 

region String length formatter 
// <summary> 
// 对字符串进行裁剪 
// </summary> 
ublic static string Trim(string stringTrim, int maxLength) 

eturn Trim(stringTrim, maxLength, "..."); 

// <summary> 
// 对字符串进行裁剪(区分单字节及双字节字符) 
// </summary> 
// <param name="rawString">需要裁剪的字符串</param> 
// <param name="maxLength">裁剪的长度，按双字节计数</param> 
// <param name="appendString">如果进行了裁剪需要附加的字符</param> 
ublic static string Trim(string rawString, int maxLength, string appendString) 

f (string.IsNullOrEmpty(rawString) || rawString.Length <= maxLength) 

eturn rawString; 

lse 

nt rawStringLength = Encoding.UTF8.GetBytes(rawString).Length; 
f (rawStringLength <= maxLength * 2) 
eturn rawString; 

nt appendStringLength = Encoding.UTF8.GetBytes(appendString).Length; 
tringBuilder checkedStringBuilder = new StringBuilder(); 
nt appendedLenth = 0; 
or (int i = 0; i < rawString.Length; i++) 

har _char = rawString[i]; 
heckedStringBuilder.Append(_char); 
ppendedLenth += Encoding.Default.GetBytes(new char[] { _char }).Length; 
f (appendedLenth >= maxLength * 2 - appendStringLength) 
reak; 

eturn checkedStringBuilder.ToString() + appendString; 

endregion 
region 特殊字符 
// <summary> 
// 检测是否有Sql危险字符 
// </summary> 
// <param name="str">要判断字符串</param> 
// <returns>判断结果</returns> 
ublic static bool IsSafeSqlString(string str) 

eturn !Regex.IsMatch(str, @"[-|;|,|\/|\(|\)|\[|\]|\}|\{|%|@|\*|!|\']"); 

// <summary> 
// 删除SQL注入特殊字符 
// 解然 20070622加入对输入参数sql为Null的判断 
// </summary> 
ublic static string StripSQLInjection(string sql) 

f (!string.IsNullOrEmpty(sql)) 

/过滤 ' -- 
tring pattern1 = @"(\')|(\')|(\-\-)"; 
/防止执行 ' or 
tring pattern2 = @"((\')|(\'))\s*((\o)|o|(\O))((\r)|r|(\R))"; 
/防止执行sql server 内部存储过程或扩展存储过程 
tring pattern3 = @"\s+exec(\s|\+)+(s|x)p\w+"; 
ql = Regex.Replace(sql, pattern1, string.Empty, RegexOptions.IgnoreCase); 
ql = Regex.Replace(sql, pattern2, string.Empty, RegexOptions.IgnoreCase); 
ql = Regex.Replace(sql, pattern3, string.Empty, RegexOptions.IgnoreCase); 

eturn sql; 

ublic static string SQLSafe(string Parameter) 

arameter = Parameter.ToLower(); 
arameter = Parameter.Replace("'", ""); 
arameter = Parameter.Replace(">", ">"); 
arameter = Parameter.Replace("<", "<"); 
arameter = Parameter.Replace("\n", ""); 
arameter = Parameter.Replace("\0", "&middot;"); 
eturn Parameter; 

// <summary> 
// 清除xml中的不合法字符 
// </summary> 
// <remarks> 
// 无效字符： 
// 0x00 - 0x08 
// 0x0b - 0x0c 
// 0x0e - 0x1f 
// </remarks> 
ublic static string CleanInvalidCharsForXML(string input) 

f (string.IsNullOrEmpty(input)) 
eturn input; 
lse 

tringBuilder checkedStringBuilder = new StringBuilder(); 
har[] chars = input.ToCharArray(); 
or (int i = 0; i < chars.Length; i++) 

nt charValue = Convert.ToInt32(chars[i]); 
f ((charValue >= 0x00 && charValue <= 0x08) || (charValue >= 0x0b && charValue <= 0x0c) || (charValue >= 0x0e && charValue <= 0x1f)) 
ontinue; 
lse 
heckedStringBuilder.Append(chars[i]); 

eturn checkedStringBuilder.ToString(); 
/string result = checkedStringBuilder.ToString(); 
/result = result.Replace("&#x0;", ""); 
/return Regex.Replace(result, @"[\?-\\ \ \-\\?-\?]", delegate(Match m) { int code = (int)m.Value.ToCharArray()[0]; return (code > 9 ? "&#" + code.ToString() : "&#0" + code.ToString()) + ";"; }); 


// <summary> 
// 改正sql语句中的转义字符 
// </summary> 
ublic static string mashSQL(string str) 

eturn (str == null) ? "" : str.Replace("\'", "'"); 

// <summary> 
// 替换sql语句中的有问题符号 
// </summary> 
ublic static string ChkSQL(string str) 

eturn (str == null) ? "" : str.Replace("'", "''"); 

// <summary> 
// 判断是否有非法字符 
// </summary> 
// <param name="strString"></param> 
// <returns>返回TRUE表示有非法字符，返回FALSE表示没有非法字符。</returns> 
ublic static bool CheckBadStr(string strString) 

ool outValue = false; 
f (strString != null && strString.Length > 0) 

tring[] bidStrlist = new string[9]; 
idStrlist[0] = "'"; 
idStrlist[1] = ";"; 
idStrlist[2] = ":"; 
idStrlist[3] = "%"; 
idStrlist[4] = "@"; 
idStrlist[5] = "&"; 
idStrlist[6] = "#"; 
idStrlist[7] = "\""; 
idStrlist[8] = "net user"; 
idStrlist[9] = "exec"; 
idStrlist[10] = "net localgroup"; 
idStrlist[11] = "select"; 
idStrlist[12] = "asc"; 
idStrlist[13] = "char"; 
idStrlist[14] = "mid"; 
idStrlist[15] = "insert"; 
idStrlist[19] = "order"; 
idStrlist[20] = "exec"; 
idStrlist[21] = "delete"; 
idStrlist[22] = "drop"; 
idStrlist[23] = "truncate"; 
idStrlist[24] = "xp_cmdshell"; 
idStrlist[25] = "<"; 
idStrlist[26] = ">"; 
tring tempStr = strString.ToLower(); 
or (int i = 0; i < bidStrlist.Length; i++) 

f (tempStr.IndexOf(bidStrlist[i]) != -1) 
/if (tempStr == bidStrlist[i]) 

utValue = true; 
reak; 



eturn outValue; 

endregion 
region Tools 
// <summary> 
// 去掉最后一个逗号 
// </summary> 
// <param name="String">要做处理的字符串</param> 
// <returns>去掉最后一个逗号的字符串</returns> 
ublic static string DelLastComma(string String) 

f (String.IndexOf(",") == -1) 

eturn String; 

eturn String.Substring(0, String.LastIndexOf(",")); 

// <summary> 
// 删除最后一个字符 
// </summary> 
// <param name="str"></param> 
// <returns></returns> 
ublic static string ClearLastChar(string str) 

eturn (str == "") ? "" : str.Substring(0, str.Length - 1); 

// <summary> 
// html编码 
// </summary> 
// <param name="chr"></param> 
// <returns></returns> 
ublic static string html_text(string chr) 

f (chr == null) 
eturn ""; 
hr = chr.Replace("'", "''"); 
hr = chr.Replace("<", "<"); 
hr = chr.Replace(">", ">"); 
eturn (chr); 

// <summary> 
// html解码 
// </summary> 
// <param name="chr"></param> 
// <returns></returns> 
ublic static string text_html(string chr) 

f (chr == null) 
eturn ""; 
hr = chr.Replace("<", "<"); 
hr = chr.Replace(">", ">"); 
eturn (chr); 

ublic static bool JustifyStr(string strValue) 

ool flag = false; 
har[] str = "^<>'=&*, ".ToCharArray(0, 8); 
or (int i = 0; i < 8; i++) 

f (strValue.IndexOf(str[i]) != -1) 

lag = true; 
reak; 


eturn flag; 

ublic static string CheckOutputString(string key) 

tring OutputString = string.Empty; 
utputString = key.Replace("", "\n").Replace("<", "<").Replace(">", ">").Replace(" ", " "); 
eturn OutputString; 

endregion 
</div>
<div>
</div>
试试其它关键字
　过滤危险字符　
同语言下
可能有用的
Dezai.CN贡献的其它代码(4037)