ASP.NETURL地址防注入過濾問題

首先在Global.asax.cs里面配置一個 提交事件  不用過濾所有的地址 過濾 GET POST的地址就行了

/// <summary>
/// 防止sql注入
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
protected void Application_BeginRequest(Object sender, EventArgs e)
{
//過濾Post參數
string url = this.Request.Url.ToString();
if(this.Request.Form.Count>0)
{
string filterUrl = FilterUrl(url);
if (!url.Equals(filterUrl))
{
this.Response.Redirect(filterUrl);
}
}
//過濾Get參數
if(this.Request.QueryString.Count>0)
{
string filterUrl = FilterUrl(url);
if (!url.Equals(filterUrl))
{
this.Response.Redirect(filterUrl);
}
}
}

 

 

 

 

/// <summary>
/// 過濾特殊字符
/// </summary>
/// <param name="url"></param>
/// <returns></returns>
private string FilterUrl(string url)
{
string replaceStr = url;
if (!string.IsNullOrEmpty(url))
{
replaceStr = replaceStr.ToLower();
replaceStr = replaceStr.Replace("<", "");
replaceStr = replaceStr.Replace(">", "");
replaceStr = replaceStr.Replace("|", "");
replaceStr = replaceStr.Replace("\"", "");
replaceStr = replaceStr.Replace("'", "");
replaceStr = replaceStr.Replace("%", "");
replaceStr = replaceStr.Replace(";", "");
replaceStr = replaceStr.Replace("(", "");
replaceStr = replaceStr.Replace(")", "");
replaceStr = replaceStr.Replace("+", "");
replaceStr = replaceStr.Replace("script", "");
replaceStr = replaceStr.Replace("alert", "");
replaceStr = replaceStr.Replace("select", "");
replaceStr = replaceStr.Replace("update", "");
replaceStr = replaceStr.Replace("insert", "");
replaceStr = replaceStr.Replace("like", "");
replaceStr = replaceStr.Replace("applet", "");
replaceStr = replaceStr.Replace("body", "");
replaceStr = replaceStr.Replace("embed", "");
replaceStr = replaceStr.Replace("frame", "");
replaceStr = replaceStr.Replace("html", "");
replaceStr = replaceStr.Replace("iframe", "");
replaceStr = replaceStr.Replace("img", "");
replaceStr = replaceStr.Replace("style", "");
replaceStr = replaceStr.Replace("layer", "");
replaceStr = replaceStr.Replace("link", "");
replaceStr = replaceStr.Replace("ilayer", "");
replaceStr = replaceStr.Replace("meta", "");
replaceStr = replaceStr.Replace("object", "");
}
return replaceStr;
}

 

 

 

 

 

 

下面是圖解：