C#. .NET to prevent SQL injection attacks

Little scum · Posted on 4/19/2015 11:32:01 PM

#region 防止sql注入式攻击(可用于UI层控制）
///
/// 判断字符串中是否有SQL攻击代码
///
/// 传入用户提交数据
/// true-安全；false-有注入攻击现有；
public bool ProcessSqlStr( string inputString)
{
string SqlStr = @"
and|or|exec|execute|insert|select|delete|update|alter|create|drop|count|\*|chr|char|asc|mid|substring|master|truncate|declare|xp_cmdshell|restore|backup|net +user|net
+localgroup +administrators " ;
try
{
if ((inputString != null ) && (inputString != String.Empty))
{
string str_Regex = @" \b( " + SqlStr + @" )\b " ;
Regex Regex = new Regex(str_Regex, RegexOptions.IgnoreCase);
// string s = Regex.Match(inputString).Value;
if ( true == Regex.IsMatch(inputString))
return false ;
}
}
catch
{
return false ;
}
return true ;
}
///
/// 处理用户提交的请求，校验sql注入式攻击,在页面装置时候运行
/// System.Configuration.ConfigurationSettings.AppSettings["ErrorPage"].ToString(); 为用户自定义错误页面提示地址,
/// 在Web.Config文件时里面添加一个 ErrorPage 即可
///
///
///
public void ProcessRequest()
{
try
{
string getkeys = "" ;
string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings[ " ErrorPage " ].ToString();
if (System.Web.HttpContext.Current.Request.QueryString != null )
{
for ( int i = 0 ; i < System.Web.HttpContext.Current.Request.QueryString.Count; i ++ )
{
getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys;
if ( ! ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys]))
{
System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage + " ?errmsg= " + getkeys + " 有SQL攻击嫌疑！ " );
System.Web.HttpContext.Current.Response.End();
}
}
}
if (System.Web.HttpContext.Current.Request.Form != null )
{
for ( int i = 0 ; i < System.Web.HttpContext.Current.Request.Form.Count; i ++ )
{
getkeys = System.Web.HttpContext.Current.Request.Form.Keys;
if ( ! ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys]))
{
System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage + " ?errmsg= " + getkeys + " 有SQL攻击嫌疑！ " );
System.Web.HttpContext.Current.Response.End();
}
}
}
}
catch
{
// 错误处理: 处理用户提交信息!
}
}
#endregion

Copy code

Our solution is:
1. First, when entering in the UI, to control the type and length of data to prevent SQL injection attacks, the system provides a function to detect injection attacks, once the injection attack is detected, the data cannot be submitted;
2. Business logic layer control, by blocking SQL keywords in a certain way inside the method, and then checking the data length to ensure that there will be no SQL database injection attack code when submitting SQL; However, after this processing, the masked characters are restored when the UI output. Therefore, the system provides functions to shield characters and functions to restore characters.
3. In the data access layer, most of the data is accessed by stored procedures, and the stored procedure parameters are accessed when called, which will also prevent injection attacks.

[WinForm] C#. .NET to prevent SQL injection attacks

Related Posts

Sections viewed