ASP.NET防SQL注入脚本程序 v2.0

分类： Asp.Net 2009-12-14 11:36 425人阅读评论(2) 收藏举报

asp.net sql 脚本 string dataset null

[c-sharp] view plain copy ?

public class SqlCheck
{
public SqlCheck()
{
//
// TODO: 在此处添加构造函数逻辑
//
}
public SqlConnection oconn()
{
SqlConnection conn = new SqlConnection();
conn.ConnectionString = ConfigurationManager.ConnectionStrings["StudyConnectionString"].ToString();
//第1种调用的方法 JK1986_CheckSql();
JK1986_CheckSql();
if ( conn.State == ConnectionState.Closed )
{
conn.Open();
}
return conn;
}
public DataTable getsource(string getds)
{
SqlConnection conn = oconn();
SqlDataAdapter da = new SqlDataAdapter(getds, conn);
DataSet ds = new DataSet();
da.Fill(ds,"news" );
return ds.Tables["news"];
}
public static void JK1986_CheckSql()
{
string jk1986_sql = "exec↓select↓drop↓alter↓exists↓union↓and↓or↓xor↓order↓mid↓asc↓execute↓xp_cmdshell↓insert↓update↓delete↓join↓declare↓char↓sp_oacreate↓wscript.shell↓xp_regwrite↓'↓;↓--";
string[] jk_sql = jk1986_sql.Split('↓');
foreach (string jk in jk_sql)
{
// -----------------------防 Post 注入-----------------------
if ( System.Web.HttpContext.Current.Request.Form != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓//n//nBlog:http://hi.baidu.com/ahhacker86 //n//nBy:aa && JK1986');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " ");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " ");
System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " ");
System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " ");
System.Web.HttpContext.Current.Response.Write("提交方式：P O S T " + " ");
System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " ");
System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + " ");
System.Web.HttpContext.Current.Response.End();
}
}
}
// -----------------------防 GET 注入-----------------------
if (System.Web.HttpContext.Current.Request.QueryString != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓//n//nBlog:http://hi.baidu.com/ahhacker86 //n//nBy:aa && JK1986');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " ");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " ");
System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " ");
System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " ");
System.Web.HttpContext.Current.Response.Write("提交方式：G E T " + " ");
System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " ");
System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + " ");
System.Web.HttpContext.Current.Response.End();
}
}
}
// -----------------------防 Cookies 注入-----------------------
if (System.Web.HttpContext.Current.Request.Cookies != null)
{
for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)
{
string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k];
string getip;
if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true)
{
System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓//n//nBlog:http://hi.baidu.com/ahhacker86 //n//nBy:aa && JK1986');</" + "script>");
System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " ");
if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
}
else
{
getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
}
System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " ");
System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " ");
System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " ");
System.Web.HttpContext.Current.Response.Write("提交方式： Cookies " + " ");
System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " ");
System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + " ");
System.Web.HttpContext.Current.Response.End();
}
}
}
}
}
}

本站仅提供存储服务，所有内容均由用户发布，如发现有害或侵权内容，请点击举报。