EntityFrameWork+MVC防SQL注入

EntityFrameWork（以后簡稱EF）作為一款ORM非常的實用，能夠大幅度的提高開發速度，但是EF的實質也是sql語句，同樣需要防sql注入，在這里利用過濾器的特性來實現過濾特殊字符。

1.首先是過濾的代碼

public class SqlFilterAttribute : FilterAttribute, IActionFilter
    {

        public void OnActionExecuted(ActionExecutedContext filterContext)
        {
            throw new NotImplementedException();
        }

        public void OnActionExecuting(ActionExecutingContext filterContext)
        {
            //獲得action的參數
            var actions = filterContext.ActionDescriptor.GetParameters();

            //遍歷所有的參數
            foreach (var action in actions)
            {
                if (action.ParameterType == typeof(string))
                {
                    if (filterContext.ActionParameters[action.ParameterName] != null)
                    {
                        filterContext.ActionParameters[action.ParameterName] = SqlFilter(filterContext.ActionParameters[action.ParameterName].ToString());
                    }
                }
            }
        }

        private const string SQL_FILTER_STRINGS = "=,',:, or ,select,update,insert,delete,declare,exec,drop,create,%,--";

        /// <summary>
        /// 過濾字符串
        /// </summary>
        /// <param name="filterStr"></param>
        /// <returns></returns>
        private string SqlFilter(string filterStr)
        {
            if (!string.IsNullOrEmpty(filterStr))
            {
                foreach (var item in SQL_FILTER_STRINGS.Split(','))
                {
                    //替換掉特殊字符
                    filterStr = filterStr.ToLower().Replace(item, "");
                }
            }
            return filterStr;
        }
    }

2.調用sql過濾

public class DefaultController : Controller
    {
        // GET: Default
        public ActionResult Index()
        {
            return View();
        }

        [HttpPost]
        [SqlFilter]
        public ActionResult Index(string s)
        {
            return View();
        }
    }

測試之后發現要求過濾的字符確實被過濾掉了。