c#.net全站防止SQL注入类的代码

复制代码 代码如下:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;

/// <summary>
/// 防SQL注入检查器
/// </summary>
public class SqlChecker
{
    //当前请求对象
    private HttpRequest request;
    //当前响应对象
    private HttpResponse response;
    //安全Url,当出现Sql注入时,将导向到的安全页面,如果没赋值,则停留在当前页面
    private string safeUrl = String.Empty;

//Sql注入时,可能出现的sql关键字,可根据自己的实际情况进行初始化,每个关键字由'|'分隔开来
    //private const string StrKeyWord = @"select|insert|delete|from|count(|drop table|update|truncate|asc(|mid(|char(|xp_cmdshell|exec master|netlocalgroup administrators|:|net user|""|or|and";
    private const string StrKeyWord = @"select|insert|delete|from|drop table|update|truncate|exec master|netlocalgroup administrators|:|net user|or|and";
    //Sql注入时,可能出现的特殊符号,,可根据自己的实际情况进行初始化,每个符号由'|'分隔开来
    //private const string StrRegex = @"-|;|,|/|(|)|[|]|}|{|%|@|*|!|'";
    private const string StrRegex = @"=|!|'";
    public SqlChecker()
    {
        //
        // TODO: 在此处添加构造函数逻辑
        //
    }
    /// <summary>
    /// 由此构造函数创建的对象,在验证Sql注入之后将停留在原来页面上
    /// </summary>
    /// <param>当前请求的 Request 对象</param>
    /// <param>当前请求的 Response 对象</param>
    public SqlChecker(HttpRequest _request, HttpResponse _response)
    {
        this.request = _request;
        this.response = _response;
    }
    /// <summary>
    /// 由此构造函数创建的对象,在验证Sql注入之后将请求将导向由 _safeUrl 指定的安全url页面上
    /// </summary>
    /// <param>当前请求的 Request 对象</param>
    /// <param>当前请求的 Response 对象</param>
    /// <param>验证Sql注入之后将导向的安全 url</param>
    public SqlChecker(HttpRequest _request, HttpResponse _response, string _safeUrl)
    {
        this.request = _request;
        this.response = _response;
        this.safeUrl = _safeUrl;
    }
    /// <summary>
    /// 只读属性 SQL关键字
    /// </summary>
    public string KeyWord
    {
        get
        {
            return StrKeyWord;
        }
    }
    /// <summary>
    /// 只读属性过滤特殊字符
    /// </summary>
    public string RegexString
    {
        get
        {
            return StrRegex;
        }
    }
    /// <summary>
    /// 当出现Sql注入时需要提示的错误信息(主要是运行一些客户端的脚本)
    /// </summary>
    public string Msg
    {
        get
        {
            string msg = "<script type='text/javascript'> "
            + " alert('请勿输入非法字符!'); ";

if (this.safeUrl == String.Empty)
                msg += " window.location.href = '" + request.RawUrl + "'";
            else
                msg += " window.location.href = '" + safeUrl + "'";