检测SQL注入式攻击代码代码,Asp.Net代码库,德仔网

代码语言
代码分类
【Asp.Net】检测SQL注入式攻击代码
作者:曾祥展 / 发布于2011/3/15/ 467
<div>
<pre><span style="color: rgb(0,0,255)">using</span> System;
<span style="color: rgb(0,0,255)">using</span> System.Text;
<span style="color: rgb(0,0,255)">using</span> System.Web;
<span style="color: rgb(0,0,255)">using</span> System.Web.UI.WebControls;
<span style="color: rgb(0,0,255)">using</span> System.Text.RegularExpressions;

<span style="color: rgb(0,0,255)">namespace</span> Common
{
	<span style="color: rgb(128,128,128)">/// <summary></span>
	<span style="color: rgb(128,128,128)">/// 页面数据校验类</span>
	<span style="color: rgb(128,128,128)">/// </summary></span>
	<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">class</span> PageValidate
	{
		<span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">static</span> Regex RegNumber = <span style="color: rgb(0,0,255)">new</span> Regex("<span style="color: rgb(139,0,0)">^[0-9]+$</span>");
		<span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">static</span> Regex RegNumberSign = <span style="color: rgb(0,0,255)">new</span> Regex("<span style="color: rgb(139,0,0)">^[+-]?[0-9]+$</span>");
		<span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">static</span> Regex RegDecimal = <span style="color: rgb(0,0,255)">new</span> Regex("<span style="color: rgb(139,0,0)">^[0-9]+[.]?[0-9]+$</span>");
		<span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">static</span> Regex RegDecimalSign = <span style="color: rgb(0,0,255)">new</span> Regex("<span style="color: rgb(139,0,0)">^[+-]?[0-9]+[.]?[0-9]+$</span>"); <span style="color: rgb(0,128,0)">//等价于^[+-]?\d+[.]?\d+$</span>
		<span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">static</span> Regex RegEmail = <span style="color: rgb(0,0,255)">new</span> Regex("<span style="color: rgb(139,0,0)">^[\\w-]+@[\\w-]+\\.(com|net|org|edu|mil|tv|biz|info)$</span>");<span style="color: rgb(0,128,0)">//w 英文字母或数字的字符串，和 [a-zA-Z0-9] 语法一样 </span>
		<span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">static</span> Regex RegCHZN = <span style="color: rgb(0,0,255)">new</span> Regex("<span style="color: rgb(139,0,0)">[\u4e00-\u9fa5]</span>");

		<span style="color: rgb(0,0,255)">public</span> PageValidate()
		{
		}


		#region 数字字符串检查		
		
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 检查Request查询字符串的键值，是否是数字，最大长度限制</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="req">Request</param></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputKey">Request的键值</param></span>
		<span style="color: rgb(128,128,128)">/// <param name="maxLen">最大长度</param></span>
		<span style="color: rgb(128,128,128)">/// <returns>返回Request查询字符串</returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">string</span> FetchInputDigit(HttpRequest req, <span style="color: rgb(0,0,255)">string</span> inputKey, <span style="color: rgb(0,0,255)">int</span> maxLen)
		{
			<span style="color: rgb(0,0,255)">string</span> retVal = <span style="color: rgb(0,0,255)">string</span>.Empty;
			<span style="color: rgb(0,0,255)">if</span>(inputKey != <span style="color: rgb(0,0,255)">null</span> && inputKey != <span style="color: rgb(0,0,255)">string</span>.Empty)
			{
				retVal = req.QueryString[inputKey];
				<span style="color: rgb(0,0,255)">if</span>(<span style="color: rgb(0,0,255)">null</span> == retVal)
					retVal = req.Form[inputKey];
				<span style="color: rgb(0,0,255)">if</span>(<span style="color: rgb(0,0,255)">null</span> != retVal)
				{
					retVal = SqlText(retVal, maxLen);
					<span style="color: rgb(0,0,255)">if</span>(!IsNumber(retVal))
						retVal = <span style="color: rgb(0,0,255)">string</span>.Empty;
				}
			}
			<span style="color: rgb(0,0,255)">if</span>(retVal == <span style="color: rgb(0,0,255)">null</span>)
				retVal = <span style="color: rgb(0,0,255)">string</span>.Empty;
			<span style="color: rgb(0,0,255)">return</span> retVal;
		}		
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 是否数字字符串</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData">输入字符串</param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">bool</span> IsNumber(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			Match m = RegNumber.Match(inputData);
			<span style="color: rgb(0,0,255)">return</span> m.Success;
		}		
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 是否数字字符串 可带正负号</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData">输入字符串</param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">bool</span> IsNumberSign(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			Match m = RegNumberSign.Match(inputData);
			<span style="color: rgb(0,0,255)">return</span> m.Success;
		}		
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 是否是浮点数</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData">输入字符串</param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">bool</span> IsDecimal(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			Match m = RegDecimal.Match(inputData);
			<span style="color: rgb(0,0,255)">return</span> m.Success;
		}		
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 是否是浮点数 可带正负号</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData">输入字符串</param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">bool</span> IsDecimalSign(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			Match m = RegDecimalSign.Match(inputData);
			<span style="color: rgb(0,0,255)">return</span> m.Success;
		}		

		#endregion

		#region 中文检测

		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 检测是否有中文字符</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData"></param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">bool</span> IsHasCHZN(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			Match m = RegCHZN.Match(inputData);
			<span style="color: rgb(0,0,255)">return</span> m.Success;
		}	

		#endregion

		#region 邮件地址
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 是否是浮点数 可带正负号</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData">输入字符串</param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">bool</span> IsEmail(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			Match m = RegEmail.Match(inputData);
			<span style="color: rgb(0,0,255)">return</span> m.Success;
		}		

		#endregion

		#region 其他

		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 检查字符串最大长度，返回指定长度的串</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="sqlInput">输入字符串</param></span>
		<span style="color: rgb(128,128,128)">/// <param name="maxLength">最大长度</param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns>			</span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">string</span> SqlText(<span style="color: rgb(0,0,255)">string</span> sqlInput, <span style="color: rgb(0,0,255)">int</span> maxLength)
		{			
			<span style="color: rgb(0,0,255)">if</span>(sqlInput != <span style="color: rgb(0,0,255)">null</span> && sqlInput != <span style="color: rgb(0,0,255)">string</span>.Empty)
			{
				sqlInput = sqlInput.Trim();							
				<span style="color: rgb(0,0,255)">if</span>(sqlInput.Length > maxLength)<span style="color: rgb(0,128,0)">//按最大长度截取字符串</span>
					sqlInput = sqlInput.Substring(0, maxLength);
			}
			<span style="color: rgb(0,0,255)">return</span> sqlInput;
		}		
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 字符串编码</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="inputData"></param></span>
		<span style="color: rgb(128,128,128)">/// <returns></returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">string</span> HtmlEncode(<span style="color: rgb(0,0,255)">string</span> inputData)
		{
			<span style="color: rgb(0,0,255)">return</span> HttpUtility.HtmlEncode(inputData);
		}
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 设置Label显示Encode的字符串</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="lbl"></param></span>
		<span style="color: rgb(128,128,128)">/// <param name="txtInput"></param></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">void</span> SetLabel(Label lbl, <span style="color: rgb(0,0,255)">string</span> txtInput)
		{
			lbl.Text = HtmlEncode(txtInput);
		}
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">void</span> SetLabel(Label lbl, <span style="color: rgb(0,0,255)">object</span> inputObj)
		{
			SetLabel(lbl, inputObj.ToString());
		}		
		<span style="color: rgb(0,128,0)">//字符串清理</span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">string</span> InputText(<span style="color: rgb(0,0,255)">string</span> inputString, <span style="color: rgb(0,0,255)">int</span> maxLength) 
		{			
			StringBuilder retVal = <span style="color: rgb(0,0,255)">new</span> StringBuilder();

			<span style="color: rgb(0,128,0)">// 检查是否为空</span>
			<span style="color: rgb(0,0,255)">if</span> ((inputString != <span style="color: rgb(0,0,255)">null</span>) && (inputString != String.Empty)) 
			{
				inputString = inputString.Trim();
				
				<span style="color: rgb(0,128,0)">//检查长度</span>
				<span style="color: rgb(0,0,255)">if</span> (inputString.Length > maxLength)
					inputString = inputString.Substring(0, maxLength);
				
				<span style="color: rgb(0,128,0)">//替换危险字符</span>
				<span style="color: rgb(0,0,255)">for</span> (<span style="color: rgb(0,0,255)">int</span> i = 0; i < inputString.Length; i++) 
				{
					<span style="color: rgb(0,0,255)">switch</span> (inputString[i]) 
					{
						<span style="color: rgb(0,0,255)">case</span> '"<span style="color: rgb(139,0,0)">':</span>
							retVal.Append(""");
							<span style="color: rgb(0,0,255)">break</span>;
						<span style="color: rgb(0,0,255)">case</span> '<':
							retVal.Append("<span style="color: rgb(139,0,0)"><</span>");
							<span style="color: rgb(0,0,255)">break</span>;
						<span style="color: rgb(0,0,255)">case</span> '>':
							retVal.Append("<span style="color: rgb(139,0,0)">></span>");
							<span style="color: rgb(0,0,255)">break</span>;
						<span style="color: rgb(0,0,255)">default</span>:
							retVal.Append(inputString[i]);
							<span style="color: rgb(0,0,255)">break</span>;
					}
				}				
				retVal.Replace("<span style="color: rgb(139,0,0)">'</span>", "<span style="color: rgb(139,0,0)"> </span>");<span style="color: rgb(0,128,0)">// 替换单引号</span>
			}
			<span style="color: rgb(0,0,255)">return</span> retVal.ToString();
			
		}
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">/// 转换成 HTML code</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="str">string</param></span>
		<span style="color: rgb(128,128,128)">/// <returns>string</returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">string</span> Encode(<span style="color: rgb(0,0,255)">string</span> str)
		{			
			str = str.Replace("<span style="color: rgb(139,0,0)">&</span>","<span style="color: rgb(139,0,0)">&</span>");
			str = str.Replace("<span style="color: rgb(139,0,0)">'</span>","<span style="color: rgb(139,0,0)">''</span>");
			str = str.Replace("<span style="color: rgb(139,0,0)">\"</span>",""");
			str = str.Replace("<span style="color: rgb(139,0,0)"> </span>","<span style="color: rgb(139,0,0)">&nbsp;</span>");
			str = str.Replace("<span style="color: rgb(139,0,0)"><</span>","<span style="color: rgb(139,0,0)"><</span>");
			str = str.Replace("<span style="color: rgb(139,0,0)">></span>","<span style="color: rgb(139,0,0)">></span>");
			str = str.Replace("<span style="color: rgb(139,0,0)">\n</span>","<span style="color: rgb(139,0,0)"></span>");
			<span style="color: rgb(0,0,255)">return</span> str;
		}
		<span style="color: rgb(128,128,128)">/// <summary></span>
		<span style="color: rgb(128,128,128)">///解析html成 普通文本</span>
		<span style="color: rgb(128,128,128)">/// </summary></span>
		<span style="color: rgb(128,128,128)">/// <param name="str">string</param></span>
		<span style="color: rgb(128,128,128)">/// <returns>string</returns></span>
		<span style="color: rgb(0,0,255)">public</span> <span style="color: rgb(0,0,255)">static</span> <span style="color: rgb(0,0,255)">string</span> Decode(<span style="color: rgb(0,0,255)">string</span> str)
		{			
			str = str.Replace("<span style="color: rgb(139,0,0)"></span>","<span style="color: rgb(139,0,0)">\n</span>");
			str = str.Replace("<span style="color: rgb(139,0,0)">></span>","<span style="color: rgb(139,0,0)">></span>");
			str = str.Replace("<span style="color: rgb(139,0,0)"><</span>","<span style="color: rgb(139,0,0)"><</span>");
			str = str.Replace("<span style="color: rgb(139,0,0)">&nbsp;</span>","<span style="color: rgb(139,0,0)"> </span>");
			str = str.Replace(""","<span style="color: rgb(139,0,0)">\"</span>");
			<span style="color: rgb(0,0,255)">return</span> str;
		}

		#endregion


	}
}</pre>
<pre>
 </pre>
<pre>
 </pre>
<pre>
 </pre>
<pre>
通用文件（Global.asax），保存为Global.asax文件名 放到网站根木马下即可。</pre>
<pre>
 </pre>
<pre>
 </pre>
<pre>
<mce:script language="<span style="color: rgb(139,0,0)">C#</span>" runat="<span style="color: rgb(139,0,0)">server</span>"><!--
	<span style="color: rgb(0,0,255)">protected</span> <span style="color: rgb(0,0,255)">void</span> Application_BeginRequest(Object sender, EventArgs e)
		{  
			StartProcessRequest(); 
    		}   

      
    <span style="color: rgb(128,128,128)">///    <summary>   </span>
    <span style="color: rgb(128,128,128)">/// 处理用户提交的请求   </span>
    <span style="color: rgb(128,128,128)">///    </summary>   </span>
    <span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">void</span> StartProcessRequest()   
    {   
        <span style="color: rgb(0,0,255)">try</span>   
        {   
            <span style="color: rgb(0,0,255)">string</span> getkeys = "";   
            
            <span style="color: rgb(0,0,255)">if</span> (System.Web.HttpContext.Current.Request.QueryString != <span style="color: rgb(0,0,255)">null</span>)   
            {   

                <span style="color: rgb(0,0,255)">for</span> (<span style="color: rgb(0,0,255)">int</span> i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++)   
                {   
                    getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];   
                    <span style="color: rgb(0,0,255)">if</span> (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys]))   
                    {   
                        System.Web.HttpContext.Current.Response.Write("<span style="color: rgb(139,0,0)">Get,出现错误,包含非法字符串</span>");   
                        System.Web.HttpContext.Current.Response.End();   
                    }   
                }   
            }   
            <span style="color: rgb(0,0,255)">if</span> (System.Web.HttpContext.Current.Request.Form != <span style="color: rgb(0,0,255)">null</span>)   
            {   
                <span style="color: rgb(0,0,255)">for</span> (<span style="color: rgb(0,0,255)">int</span> i = 0; i < System.Web.HttpContext.Current.Request.Form.Count; i++)   
                {   
                    getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i];   
                    <span style="color: rgb(0,0,255)">if</span> (getkeys == "<span style="color: rgb(139,0,0)">__VIEWSTATE</span>") <span style="color: rgb(0,0,255)">continue</span>;   
                    <span style="color: rgb(0,0,255)">if</span> (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys]))   
                    {   
                        System.Web.HttpContext.Current.Response.Write("<span style="color: rgb(139,0,0)">Post,出现错误,包含非法字符串</span>");   
                        System.Web.HttpContext.Current.Response.End();   
                    }   
                }   
            } 
			<span style="color: rgb(0,0,255)">if</span>(System.Web.HttpContext.Current.Request.Cookies!=<span style="color: rgb(0,0,255)">null</span>) 
			{
			    <span style="color: rgb(0,0,255)">for</span> (<span style="color: rgb(0,0,255)">int</span> i = 0; i < System.Web.HttpContext.Current.Request.Cookies.Count; i++)   
                {   
                    getkeys = System.Web.HttpContext.Current.Request.Cookies.Keys[i];   
                    <span style="color: rgb(0,0,255)">if</span> (getkeys == "<span style="color: rgb(139,0,0)">__VIEWSTATE</span>") <span style="color: rgb(0,0,255)">continue</span>;   
                    <span style="color: rgb(0,0,255)">if</span> (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Cookies[getkeys].Value))   
                    {   
                        System.Web.HttpContext.Current.Response.Write("<span style="color: rgb(139,0,0)">Cookies,出现错误,包含非法字符串</span>");   
                        System.Web.HttpContext.Current.Response.End();   
                    }   
                }   
			} 
	
        }   
        <span style="color: rgb(0,0,255)">catch</span>   
        {   
            <span style="color: rgb(0,128,0)">// 错误处理: 处理用户提交信息!   </span>
        }   
    }   
    <span style="color: rgb(128,128,128)">///    <summary>   </span>
    <span style="color: rgb(128,128,128)">/// 分析用户请求是否正常   </span>
    <span style="color: rgb(128,128,128)">///    </summary>   </span>
    <span style="color: rgb(128,128,128)">///    <param name="Str">传入用户提交数据   </param>   </span>
    <span style="color: rgb(128,128,128)">///    <returns>返回是否含有SQL注入式攻击代码   </returns>   </span>
    <span style="color: rgb(0,0,255)">private</span> <span style="color: rgb(0,0,255)">bool</span> ProcessSqlStr(<span style="color: rgb(0,0,255)">string</span> Str)   
    {   
        <span style="color: rgb(0,0,255)">bool</span> ReturnValue = <span style="color: rgb(0,0,255)">true</span>;   
        <span style="color: rgb(0,0,255)">try</span>   
        {   
            <span style="color: rgb(0,0,255)">if</span> (Str.Trim() != "")   
            {   
				<span style="color: rgb(0,0,255)">string</span> SqlStr = "<span style="color: rgb(139,0,0)">select|insert|delete|update|declare|sysobjects|syscolumns|cast|truncate|master|mid|exec</span>";   

				<span style="color: rgb(0,0,255)">string</span>[] anySqlStr = SqlStr.Split('|');    
                <span style="color: rgb(0,0,255)">foreach</span> (<span style="color: rgb(0,0,255)">string</span> ss <span style="color: rgb(0,0,255)">in</span> anySqlStr)   
                {   
                    <span style="color: rgb(0,0,255)">if</span> (Str.ToLower().IndexOf(ss) >= 0)   
                    {   
                        ReturnValue = <span style="color: rgb(0,0,255)">false</span>;   
                        <span style="color: rgb(0,0,255)">break</span>;   
                    }   
                }   
            }   
        }   
        <span style="color: rgb(0,0,255)">catch</span>   
        {   
            ReturnValue = <span style="color: rgb(0,0,255)">false</span>;   
        }   
        <span style="color: rgb(0,0,255)">return</span> ReturnValue;   
    }   
  <span style="color: rgb(0,128,0)">// --></mce:script></span></pre>
<pre><span style="color: rgb(0,128,0)"> </span></pre>
</div>
试试其它关键字
同语言下
可能有用的
曾祥展贡献的其它代码(13)