1 using System;
 2 using System.Linq;
 3 using System.Text;
 4 using System.Text.RegularExpressions;
 5 using System.Web;
 6 
 7 namespace HOST_CONTROL_CENTER.Uril.DBHelper
 8 {
 9     /// <summary>
10     /// 防sql注入關鍵詞檢測
11     /// sql關鍵詞與xss攻擊語句
12     /// 注：儘量使用引數化傳值不要拼接sql
13     /// </summary>
14     public
 
 class SafeSqlHelper
15     {
16         private const string StrRegex = @"<[^>]+?style=[\w]+?:expression\(|\b(alert|confirm|prompt)\b|^\+/v(8|9)|<[^>]*?=[^>]*?&#[^>]*?>|\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|<\s*img\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)
 
";
17         public static bool PostData()
18         {
19             bool result = false;
20             for (int i = 0; i < HttpContext.Current.Request.Form.Count; i++)
21             {
22                 result = CheckData(HttpContext.Current.Request.Form[i].ToString());
23                 if (result)
 
24                 {
25                     break;
26                 }
27             }
28             return result;
29         }
30 
31         /// <summary>
32         /// 獲取資料
33         /// </summary>
34         /// <returns></returns>
35         public static bool GetData()
36         {
37             bool result = false;
38             for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++)
39             {
40                 result = CheckData(HttpContext.Current.Request.QueryString[i].ToString());
41                 if (result)
42                 {
43                     break;
44                 }
45             }
46             return result;
47         }
48         /// <summary>
49         /// Cookie資料
50         /// </summary>
51         /// <returns></returns>
52         public static bool CookieData()
53         {
54             bool result = false;
55             for (int i = 0; i < HttpContext.Current.Request.Cookies.Count; i++)
56             {
57                 result = CheckData(HttpContext.Current.Request.Cookies[i].Value.ToLower());
58                 if (result)
59                 {
60                     break;
61                 }
62             }
63             return result;
64 
65         }
66         public static bool referer()
67         {
68             bool result = false;
69             return result = CheckData(HttpContext.Current.Request.UrlReferrer.ToString());
70         }
71 
72         /// <summary>
73         /// 檢查資料
74         /// </summary>
75         /// <param name="inputData"></param>
76         /// <returns></returns>
77         public static bool CheckData(string inputData)
78         {
79             if (Regex.IsMatch(inputData, StrRegex))
80             {
81                 return true;
82             }
83             else
84             {
85                 return false;
86             }
87         }
88     }
89 }

注：儘量使用引數化傳值，減少sql拼接