过滤sql特殊字符方法集合

/// <summary>
    /// 过滤不安全的字符串
    /// </summary>
    /// <param name="Str"></param>
    /// <returns></returns>
    public static string FilteSQLStr( string Str)
    {

Str = Str.Replace( " ' " , "" );
        Str = Str.Replace( " /" " , "" );
        Str = Str.Replace( " & " , " &amp " );
        Str = Str.Replace( " < " , " &lt " );
        Str = Str.Replace( " > " , " &gt " );

Str = Str.Replace( " delete " , "" );
Str = Str.Replace( " update " , "" );
Str = Str.Replace( " insert " , "" );

return Str;
}

#region 过滤 Sql 语句字符串中的注入脚本
        /// <summary>
        /// 过滤 Sql 语句字符串中的注入脚本
        /// </summary>
        /// <param name="source"> 传入的字符串 </param>
        /// <returns> 过滤后的字符串 </returns>
        public static string SqlFilter( string source)
        {
            // 单引号替换成两个单引号
            source = source.Replace( " ' " , " '' " );

// 半角封号替换为全角封号，防止多语句执行
source = source.Replace( " ; " , " ； " );

// 半角括号替换为全角括号
source = source.Replace( " ( " , " （ " );
source = source.Replace( " ) " , " ） " );

/////////////// 要用正则表达式替换，防止字母大小写得情况 ////////////////// //

// 去除执行存储过程的命令关键字
source = source.Replace( " Exec " , "" );
source = source.Replace( " Execute " , "" );

// 去除系统存储过程或扩展存储过程关键字
source = source.Replace( " xp_ " , " x p_ " );
source = source.Replace( " sp_ " , " s p_ " );

// 防止16进制注入
source = source.Replace( " 0x " , " 0 x " );

return source;
}
#endregion

/// 过滤SQL字符。
        /// </summary>
        /// <param name="str"> 要过滤SQL字符的字符串。 </param>
        /// <returns> 已过滤掉SQL字符的字符串。 </returns>
        public static string ReplaceSQLChar( string str)
        {
            if (str == String.Empty)
                return String.Empty; str = str.Replace( " ' " , " ‘ " );
            str = str.Replace( " ; " , " ； " );
            str = str.Replace( " , " , " , " );
            str = str.Replace( " ? " , " ? " );
            str = str.Replace( " < " , " ＜ " );
            str = str.Replace( " > " , " ＞ " );
            str = str.Replace( " ( " , " ( " );
            str = str.Replace( " ) " , " ) " );
            str = str.Replace( " @ " , " ＠ " );
            str = str.Replace( " = " , " ＝ " );
            str = str.Replace( " + " , " ＋ " );
            str = str.Replace( " * " , " ＊ " );
            str = str.Replace( " & " , " ＆ " );
            str = str.Replace( " # " , " ＃ " );
            str = str.Replace( " % " , " ％ " );
            str = str.Replace( " $ " , " ￥ " );

return str;
}
4.

/// <summary>
/// 过滤标记
/// </summary>
/// <param name="NoHTML"> 包括HTML，脚本，数据库关键字，特殊字符的源码 </param>
/// <returns> 已经去除标记后的文字 </returns>
public string NoHtml( string Htmlstring)
{
    if (Htmlstring == null )
    {
        return "" ;
    }
    else
    {
        // 删除脚本
         Htmlstring = Regex.Replace(Htmlstring, @" <script[^>]*?>.*?</script> " , "" , RegexOptions.IgnoreCase);
        // 删除HTML
        Htmlstring = Regex.Replace(Htmlstring, @" <(.[^>]*)> " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" ([/r/n])[/s]+ " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" --> " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" <!--.* " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(quot|#34); " , " /" " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(amp|#38); " , " & " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(lt|#60); " , " < " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(gt|#62); " , " > " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(nbsp|#160); " , " " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(iexcl|#161); " , " /xa1 " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(cent|#162); " , " /xa2 " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(pound|#163); " , " /xa3 " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &(copy|#169); " , " /xa9 " , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, @" &#(/d+); " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " xp_cmdshell " , "" , RegexOptions.IgnoreCase);

// 删除与数据库相关的词
         Htmlstring = Regex.Replace(Htmlstring, " select " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " insert " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " delete from " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " count'' " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " drop table " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " truncate " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " asc " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " mid " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " char " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " xp_cmdshell " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " exec master " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " net localgroup administrators " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " and " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " net user " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " or " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " net " , "" , RegexOptions.IgnoreCase);
        // Htmlstring = Regex.Replace(Htmlstring, "*", "", RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " - " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " delete " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " drop " , "" , RegexOptions.IgnoreCase);
        Htmlstring = Regex.Replace(Htmlstring, " script " , "" , RegexOptions.IgnoreCase);

// 特殊的字符
         Htmlstring = Htmlstring.Replace( " < " , "" );
        Htmlstring = Htmlstring.Replace( " > " , "" );
        Htmlstring = Htmlstring.Replace( " * " , "" );
        Htmlstring = Htmlstring.Replace( " - " , "" );
        Htmlstring = Htmlstring.Replace( " ? " , "" );
        Htmlstring = Htmlstring.Replace( " ' " , " '' " );
        Htmlstring = Htmlstring.Replace( " , " , "" );
        Htmlstring = Htmlstring.Replace( " / " , "" );
        Htmlstring = Htmlstring.Replace( " ; " , "" );
        Htmlstring = Htmlstring.Replace( " */ " , "" );
        Htmlstring = Htmlstring.Replace( " /r/n " , "" );
        Htmlstring = HttpContext.Current.Server.HtmlEncode(Htmlstring).Trim();

return Htmlstring;
}
}

; i < pattern.Length; i ++ )
{
str = str.Replace(pattern[i].ToString(), "" );
}
return str;
}

过滤sql特殊字符方法集合的更多相关文章

C# 过滤sql特殊字符方法集合
1./// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str" ...
mssql sql语句过滤百分号的方法分享
转自:http://www.maomao365.com/?p=6743 摘要: 下文讲述sql脚本中过滤百分号的方法: 实验环境:sql server 2008 R2 百分号:在sql脚本编写中“百 ...
C# 过滤sql特殊字符串方法
1. /// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str" ...
jQuery过滤选择器:not()方法使用介绍
在jQuery的早期版本中,:not()筛选器只支持简单的选择器,说明我们传入到:not这个filter中的selector可以任意复杂,比如:not(div a) and :not(div,a) & ...
SQL特殊字符转义
原文链接: SQL特殊字符转义应该说,您即使没有处理 HTML 或 JavaScript 的特殊字符,也不会带来灾难性的后果,但是如果不在动态构造 SQL 语句时对变量中特殊字符进行处理,将可能导 ...
TP5：使用了INPUT函数来接收参数了，还需再过滤SQL注入吗
TP5:使用了INPUT函数来接收参数了,还需再过滤SQL注入吗,默认的INPUT函数都做了哪些动作啊有了PDO参数绑定基本上不需要考虑sql注入的问题(除非自己拼接SQL),需要考虑的是XSS方 ...
jQuery过滤选择器:not()方法介绍
jQuery(':not(selector)') 在jQuery的早期版本中,:not()筛选器只支持简单的选择器,说明我们传入到:not这个filter中的selector可以任意复杂,比如:not ...
.net 过滤 sql防注入类，省地以后每次都要重新弄！
/// <summary> /// 过滤不安全的字符串 /// </summary> /// <param name="Str"&g ...
5.用通配符进行过滤 ---SQL
一.LIKE操作符通配符(wildcard) 用来匹配值的一部分的特殊字符.搜索模式(search pattern)由字面值.通配符或两者组合构成的搜索条件.通配符本身实际上是SQL的WHERE子句 ...

随机推荐

37.如何把握好 transition 和 animation 的时序，创作描边按钮特效
原文地址:https://segmentfault.com/a/1190000015089396 拓展地址:https://scrimba.com/c/cWqNNnC2 HTML code: < ...
《算法》第四章部分程序 part 18
▶ 书中第四章部分程序,包括在加上自己补充的代码,在有权有向图中寻找环,Bellman - Ford 算法求最短路径,套汇算法 ● 在有权有向图中寻找环 package package01; impo ...
smfony
1.smfony设置量表之间的关系 2.smyfony2-curd-数据库创建 3.smyfony2 增删改查 4. 5. 6.
js常用函数的封装
1://截取url带过来的参数 function getvl(name) { var reg = new RegExp("(^|\\?|&)" + name + " ...
electron 项目的打包方式，以及 jquery 插件的修改使用
< 一 > 应用打包 1,首先确定安装了 node 和 npm 2,全局安装打包依赖 => npm i electron-packager -g 3,打包命令 electron-p ...
nginx 配置文件配置
server { listen 80 ; server_name test.com www.test.com; index index.html index.php index.htm; root / ...
American Football Vocabulary!
American Football Vocabulary! Share Tweet Share You’ll learn all about the vocabulary of American fo ...
How to Pronounce Work vs. Walk
How to Pronounce Work vs. Walk Share Tweet Share Tagged With: Comparison If you’re confused about th ...
处理TypeError: Converting circular structure to JSON
// Demo: Circular reference var o = {}; o.o = o; // Note: cache should not be re-used by repeated ca ...
SQL 语句写法
SELECT * FROM article where userid=4 order by sort asc LIMIT 0,10; 先根据写where 条件,再排序,在LIMIT.

过滤sql特殊字符方法集合

过滤sql特殊字符方法集合的更多相关文章

随机推荐

热门专题