asp.net 防止sql注入 global 文件控制

using System;

using System.Collections;

using System.ComponentModel;

using System.Web;

using System.Web.SessionState;

using log4net;



namespace WebCheminfo 

{

	/// <summary>

	/// Global 的摘要说明。

	/// </summary>



	public class Global : System.Web.HttpApplication

	{

		/// <summary>

		/// 必需的设计器变量。

		/// </summary>

		private System.ComponentModel.IContainer components = null;

      

		public Global()

		{

			InitializeComponent();

		}	

		

		protected void Application_Start(Object sender, EventArgs e)

		{

		}

 

		protected void Session_Start(Object sender, EventArgs e)

		{



		}



		/// <summary>

		/// 防止SQL注入

		/// </summary>

		/// <param name="sender"></param>

		/// <param name="e"></param>

		void Application_BeginRequest(Object sender, EventArgs e)

		{

        

			StartProcessRequest();



		}



		#region SQL注入式攻击代码分析

		/// <summary> 

		/// 处理用户提交的请求 

		/// </summary> 

		private void StartProcessRequest()

		{

			 

				string getkeys = "";

				string sqlErrorPage = "~/";//转向的错误提示页面 

				if (System.Web.HttpContext.Current.Request.QueryString != null)

				{



					for (int i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++)

					{

						getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];

						if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys]))

						{

							System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage);

							System.Web.HttpContext.Current.Response.End();

						}

					}

				}

//				if (System.Web.HttpContext.Current.Request.Form != null)

//				{

//					for (int i = 0; i < System.Web.HttpContext.Current.Request.Form.Count; i++)

//					{

//						getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i];

//						if (getkeys == "__VIEWSTATE") continue;

//						if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys]))

//						{

//							System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage);

//							System.Web.HttpContext.Current.Response.End();

//						}

//					}

//				}

			 

		}



		/// <summary> 

		/// 分析用户请求是否正常 

		/// </summary> 

		/// <param name="Str">传入用户提交数据 </param> 

		/// <returns>返回是否含有SQL注入式攻击代码 </returns> 

		private bool ProcessSqlStr(string Str)

		{

			bool ReturnValue = true;

			try

			{

				if (Str.Trim() != "")

				{

					string SqlStr = " exec.update.declare.exe.varchar.truncate.create";



					string[] anySqlStr = SqlStr.Split('.');

					foreach (string ss in anySqlStr)

					{

						if (Str.ToLower().IndexOf(ss) !=-1)

						{

							ReturnValue = false;

							break;

						}

					}

				}

			}

			catch

			{

				ReturnValue = false;

			}

			return ReturnValue;

		}

		#endregion



		protected void Application_EndRequest(Object sender, EventArgs e)

		{



		}



		protected void Application_AuthenticateRequest(Object sender, EventArgs e)

		{



		}



		protected void Application_Error(Object sender, EventArgs e)

		{



		}



		protected void Session_End(Object sender, EventArgs e)

		{



		}



		protected void Application_End(Object sender, EventArgs e)

		{



		}

			

		#region Web 窗体设计器生成的代码

		/// <summary>

		/// 设计器支持所需的方法 - 不要使用代码编辑器修改

		/// 此方法的内容。

		/// </summary>

		private void InitializeComponent()

		{    

			this.components = new System.ComponentModel.Container();

		}

		#endregion

	}

}