ASP.NET filter class SqlFilter to prevent SQL injection

What is SQL injection?

The sql injection I understand is that some people can input malicious parameters to let the background execute this SQL, and then achieve the purpose of obtaining data or destroying the database!
To give a simple query example, the background sql is spliced: select * from Test where name='+parameter transfer+'; the front page requires entering name, then the hacker can enter: ';DROP TABLE Test;-- Don't Look down on this piece of SQL code:
select * from Test where name=' ';DROP TABLE Test;--'; It is correct and executable in SQL, but after execution, the entire Test table is deleted and the website crashes !

The best solution

The best way is not to write splicing SQL, but to use parameterized SQL, which is recommended for new projects. There is no introduction here. Interested friends can search for it by themselves. The method introduced in this article is suitable for old projects, that is, there are no programs developed using parameterized SQL.

Use the filter function to filter

Remove some dangerous SQL keywords, as well as comment percent signs and semicolons, which are characters that do not appear at all when we write code normally. Filter out, which can ensure the safety of SQL execution to the greatest extent. The code is as follows:

public class SqlFilter
{
  public static void Filter()
  {
    string fileter_sql = "execute,exec,select,insert,update,delete,create,drop,alter,exists,table,sysobjects,truncate,union,and,order,xor,or,mid,cast,where,asc,desc,xp_cmdshell,join,declare,nvarchar,varchar,char,sp_oacreate,wscript.shell,xp_regwrite,',%,;,--";
    try
    {
      // -----------------------防 Post 注入-----------------------
      if (HttpContext.Current.Request.Form != null)
      {
        PropertyInfo isreadonly = typeof(System.Collections.Specialized.NameValueCollection).GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);
        //把 Form 属性改为可读写
        isreadonly.SetValue(HttpContext.Current.Request.Form, false, null);
 
        for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)
        {
          string getsqlkey = HttpContext.Current.Request.Form.Keys[k];
          string sqlstr = HttpContext.Current.Request.Form[getsqlkey];
          string[] replace_sqls = fileter_sql.Split(&#39;,&#39;);
          foreach (string replace_sql in replace_sqls)
          {
            sqlstr = Regex.Replace(sqlstr, replace_sql, "", RegexOptions.IgnoreCase);
          }
          HttpContext.Current.Request.Form[getsqlkey] = sqlstr;
        }
      }
 
 
      // -----------------------防 GET 注入-----------------------
      if (HttpContext.Current.Request.QueryString != null)
      {
        PropertyInfo isreadonly = typeof(System.Collections.Specialized.NameValueCollection).GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);
        //把 QueryString 属性改为可读写
        isreadonly.SetValue(HttpContext.Current.Request.QueryString, false, null);
 
        for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)
        {
          string getsqlkey = HttpContext.Current.Request.QueryString.Keys[k];
          string sqlstr = HttpContext.Current.Request.QueryString[getsqlkey];
          string[] replace_sqls = fileter_sql.Split(&#39;,&#39;);
          foreach (string replace_sql in replace_sqls)
          {
            sqlstr = Regex.Replace(sqlstr, replace_sql, "", RegexOptions.IgnoreCase);
          }
          HttpContext.Current.Request.QueryString[getsqlkey] = sqlstr;
        }
      }
 
 
      // -----------------------防 Cookies 注入-----------------------
      if (HttpContext.Current.Request.Cookies != null)
      {
        PropertyInfo isreadonly = typeof(System.Collections.Specialized.NameValueCollection).GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);
        //把 Cookies 属性改为可读写
        isreadonly.SetValue(HttpContext.Current.Request.Cookies, false, null);
 
        for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)
        {
          string getsqlkey = HttpContext.Current.Request.Cookies.Keys[k];
          string sqlstr = HttpContext.Current.Request.Cookies[getsqlkey].Value;
          string[] replace_sqls = fileter_sql.Split(&#39;,&#39;);
          foreach (string replace_sql in replace_sqls)
          {
            sqlstr = Regex.Replace(sqlstr, replace_sql, "", RegexOptions.IgnoreCase);
          }
          HttpContext.Current.Request.Cookies[getsqlkey].Value = sqlstr;
        }
      }
    }
    catch (Exception ex)
    {
      Console.WriteLine(ex.Message);
    }
 
  }
 
}

More ASP.NET filtering class SqlFilter to prevent SQL injection. For related articles, please pay attention to the PHP Chinese website!