通過Global.asax過濾關鍵字 防止sql注入

從別的地方看到的，在此記錄一下，方法有待考察

通過Global.asax過濾關鍵字
方法一：
protected void Application_BeginRequest(Object sender, EventArgs e)
    {
        //SQL防注入
        string Sql_1 = "exec|insert+|select+|delete|update|count|chr|mid|master+|truncate|char|declare|drop+|drop+table|creat+|creat+table";
        string Sql_2 = "exec+|insert+|delete+|update+|count(|count+|chr+|+mid(|+mid+|+master+|truncate+|char+|+char(|declare+|drop+|creat+|drop+table|creat+table";
        string[] sql_c = Sql_1.Split('|');
        string[] sql_c1 = Sql_2.Split('|');

        if (Request.QueryString != null)
        {
            foreach (string sl in sql_c)
            {
                if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= 0)
                {
                    Response.Write("警告！你的IP已經被記錄!");//
                    Response.Write(sl);
                    Response.Write(Request.QueryString.ToString());
                    Response.End();
                    break;
                }
            }
        }

        if (Request.Form.Count > 0)
        {
            string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服務器名稱
            if (Request.ServerVariables["HTTP_REFERER"] != null)
            {
                string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名稱
                string s3 = "";
                if (s1.Length > (s2.Length - 7))
                {
                    s3 = s2.Substring(7);
                }
                else
                {
                    s3 = s2.Substring(7, s1.Length);
                }
                if (s3 != s1)
                {
                    Response.Write("你的IP已被記錄！警告！");//
                    Response.End();
                }
            }
        }
    }
    
    方法二：
      /// <summary>
    /// 當有數據時交時，觸發事件
    /// </summary>
    /// <param name="sender"></param>
    /// <param name="e"></param>
    protected void Application_BeginRequest(Object sender, EventArgs e)
    {
        //遍歷Post參數，隱藏域除外
        foreach (string i in this.Request.Form)
        {
            if (i == "__VIEWSTATE") continue;
            this.goErr(this.Request.Form[i].ToString());
        }
        //遍歷Get參數。
        foreach (string i in this.Request.QueryString)
        {
            this.goErr(this.Request.QueryString[i].ToString()); 

        }

    }

    /// <summary>
    ///SQL注入過濾
    /// </summary>
    /// <param name="InText">要過濾的字符串</param>
    /// <returns>如果參數存在不安全字符，則返回true</returns>
    public bool SqlFilter(string InText)
    {
        string word = "and|exec|insert|select|delete|update|chr|mid|master|or|truncate|char|declare|join|cmd|;|'|--";//這里加要過濾的SQL字符
        if (InText == null)
            return false;
        foreach (string i in word.Split('|'))
        {
            if ((InText.ToLower().IndexOf(i + " ") > -1) || (InText.ToLower().IndexOf(" " + i) > -1))
            {
                return true;
            }
        }
        return false;
    }

    /// <summary>
    /// 校驗參數是否存在SQL字符
    /// </summary>
    /// <param name="tm"></param>
    private void goErr(string tm)
    {
        if (SqlFilter(tm))
        {
            Response.Write("<script>window.alert('參數存在不安全字符');"+"</"+"script>");
        }
    }