Do the following three steps, I believe that the program will be more secure, and the entire site will be the maintenance of a simple change.
First, the Data validation class:
ParameterCheck.cs
Copy Code code as follows:
public class parametercheck{
public static bool Isemail (string emailstring) {
Return System.Text.RegularExpressions.Regex.IsMatch (emailstring, "[' \\w_-]+" (\\.[' \\w_-]+) *@[' \\w_-]+ (\\.[' \\w_-]+) *\\. [A-za-z] {2,4} ");
}
public static bool Isint (string intstring) {
Return System.Text.RegularExpressions.Regex.IsMatch (intstring, "^ (\\d{5}-\\d{4}) |" ( \\D{5}) $ ");
}
public static bool Isuszip (string zipstring) {
Return System.Text.RegularExpressions.Regex.IsMatch (zipstring, "^-[0-9]+$|^[0-9]+$");
}
}
Second, web.config
In your Web.config file, add a label below <appSettings>:
Copy Code code as follows:
<appSettings>
<add key= "Safeparameters" value= "Orderid-int32,customeremail-email,shippingzipcode-uszip"/>
</appSettings>
Where key is <saveParameters> after the value is "Orderid-int32", where "-" preceded by the name of the parameter, such as: OrderId, followed by the int32 represents the data type.
Third, Global.asax
Add the following paragraph to the Global.asax:
Copy Code code as follows:
protected void Application_BeginRequest (Object sender, EventArgs e) {
string[] safeparameters = system.configuration.configurationsettings.appsettings["SafeParameters"]. ToString (). Split (', ');
for (int i= 0; i < safeparameters.length; i++) {
String parametername = safeparameters[i]. Split ('-') [0];
String parametertype = safeparameters[i]. Split ('-') [1];
Isvalidparameter (ParameterName, parametertype);
}
}
public void Isvalidparameter (string parametername, String parametertype) {
String parametervalue = Request.querystring[parametername];
if (ParameterValue = null) return;
if (Parametertype.equals ("Int32")) {
if (!parametercheck.isint (ParameterValue)) Response.Redirect ("parametererror.aspx");
}
else if (parametertype.equals ("double")) {
if (!parametercheck.isdouble (ParameterValue)) Response.Redirect ("parametererror.aspx");
}
else if (parametertype.equals ("Uszip")) {
if (!parametercheck.isuszip (ParameterValue)) Response.Redirect ("parametererror.aspx");
}
else if (parametertype.equals ("email")) {
if (!parametercheck.isemail (ParameterValue)) Response.Redirect ("parametererror.aspx");
}
}
Later need to modify the time we only need to modify the above three files, the entire system maintenance will be greatly improved efficiency, of course, you can according to their own needs to add other variable parameters and data types.