ASP.NET防止SQL注入的方法示例

void Application_BeginRequest(object sender, EventArgs e)
{
 bool result = false;
 if (Request.RequestType.ToUpper() == "POST")
 {
 //post方式的我就不寫了。
 }
 else
 {
 result = ValidUrlGetData();
 }
 if (result)
 {
 Response.Write("您提交的數據有惡意字符！");
 Response.End();
 }
}
/// <summary>
/// 獲取QueryString中的數據
/// </summary>
public static bool ValidUrlGetData()
{
 bool result = false;
 for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++)
 {
 result = Validate(HttpContext.Current.Request.QueryString[i].ToString());
 if (result)
 {
 break;
 }//如果檢測存在漏洞
 }
 return result;
}
public static string []strs = new string[] {"select","drop","exists","exec","insert","delete","update","and","or","user" };//此處我隨便加了幾個，大家可以多加點哈。
public static bool Validate(string str)
{
 for (int i = 0; i < strs.Length; i++)
 {
 if (str.IndexOf(strs[i]) != -1)
 {
 return true;
 break;
 }
 }
 return false;
}