ASP. NET address SQL injection code

 Public Static classCheckchar {#regionAnalysis of SQL injection-type attack code/// <summary>        ///handling user-submitted requests/// </summary>         Public Static voidstartprocessrequest () {Try            {                stringGetkeys =""; //prevent get injection                if(System.Web.HttpContext.Current.Request.QueryString! =NULL)                {                    if(System.Web.HttpContext.Current.Request.QueryString.Count = =0)                    {                        stringURL =""; if(System.Web.HttpContext.Current.Request.UrlReferrer! =NULL) {URL=System.Web.HttpContext.Current.Request.UrlReferrer.ToString (); }                        if(URL.) Length >0) {URL= URL. Substring (URL. IndexOf ('?') +1Url. Length-url. IndexOf ('?') -1); }                        if(! Processsqlstr (URL,"Get"))                        {                            //System.Web.HttpContext.Current.Response.Write ("//System.Web.HttpContext.Current.Response.End ();System.Web.HttpContext.Current.Response.Redirect ("~/error.aspx?path="+System.Web.HttpContext.Current.Request.Url.PathAndQuery); }                    }                    Else                    {                         for(inti =0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++) {Getkeys=System.web.httpcontext.current.request.querystring.keys[i]; if(! Processsqlstr (System.web.httpcontext.current.request.querystring[getkeys],"Get") {System.Web.HttpContext.Current.Response.Redirect ("~/error.aspx?path="+System.Web.HttpContext.Current.Request.Url.PathAndQuery); }                        }                    }                }                //prevent post injection                if(System.Web.HttpContext.Current.Request.Form! =NULL)                {                     for(inti =0; i < System.Web.HttpContext.Current.Request.Form.Count; i++) {Getkeys=System.web.httpcontext.current.request.form.keys[i]; if(Getkeys = ="__viewstate"|| Getkeys = ="__eventvalidation")Continue; if(! Processsqlstr (System.web.httpcontext.current.request.form[getkeys],"Post") {System.Web.HttpContext.Current.Response.Redirect ("~/error.aspx?path="+System.Web.HttpContext.Current.Request.Url.PathAndQuery); }                    }                }                //Prevent cookits injection                if(System.Web.HttpContext.Current.Request.Cookies! =NULL)                {                     for(inti =0; i < System.Web.HttpContext.Current.Request.Cookies.Count; i++) {Getkeys=System.web.httpcontext.current.request.cookies.keys[i]; if(Getkeys = ="__viewstate")Continue; if(! Processsqlstr (System.web.httpcontext.current.request.cookies[getkeys]. Value,"Cookies") {System.Web.HttpContext.Current.Response.Redirect ("~/error.aspx?path="+System.Web.HttpContext.Current.Request.Url.PathAndQuery); }                    }                }            }            Catch            {            }        }        /// <summary>        ///Analyze whether user requests are normal/// </summary>        /// <param name= "Str" >incoming user submission data</param>        /// <returns>returns whether a SQL injection attack code is included</returns>         Public Static BOOLPROCESSSQLSTR (stringStrstringtype) {            BOOLReturnValue =true; Try            {                if(Str.trim ()! ="")                {                    //string sqlstr = "And¦exec¦insert¦select¦delete¦update¦count¦*¦chr¦mid¦master¦truncate¦char¦declare";/¦%2F //string sqlstr = "iframe|xp_loginconfig|xp_fixeddrives| Xp_regremovemultistring| xp_regread| Xp_regwrite|xp_cmdshell|xp_dirtree|count (|*|ASC (|CHR (|substring (|mid (|master|truncate|char) (|declare|and|or|=|%| Replace (|;| varchar (|cast exec¦insert¦select¦delete¦update¦mid¦master¦truncate¦declare¦script¦ ' ¦%27¦ (¦%28¦) ¦%29¦+¦%2B¦-¦%2D ¦¦;¦%3b¦<¦%3c¦=¦%3d¦>¦%3e¦|¦%7c ";                    stringSqlstr =string.                    Empty; if(Type. Equals ("Post")) Sqlstr="%5c¦\\¦.jsp¦iframe¦xp_loginconfig¦xp_fixeddrives¦xp_regremovemultistring¦xp_regread¦xp_regwrite¦xp_ Cmdshell¦xp_dirtree¦count (¦*¦ASC (¦CHR (¦substring (¦mid (¦master¦truncate¦char (¦declare¦and¦or¦replace) (¦;¦varchar (¦cast¦exec¦insert¦select¦delete¦update¦mid¦master¦truncate¦declare¦script¦alert¦%27¦ (¦%28¦) ¦%29¦ ' ¦+¦%2B¦%2D¦; ¦%3b¦<¦%3c¦%3d¦>¦%3e¦%7c"; Elsesqlstr="%5c¦\\¦.jsp¦iframe¦xp_loginconfig¦xp_fixeddrives¦xp_regremovemultistring¦xp_regread¦xp_regwrite¦xp_ Cmdshell¦xp_dirtree¦count (¦*¦ASC (¦CHR (¦substring (¦mid (¦master¦truncate¦char (¦declare¦and¦or¦replace) (¦;¦varchar (¦cast¦exec¦insert¦select¦delete¦update¦mid¦master¦truncate¦declare¦script¦alert¦%27¦ (¦%28¦) ¦%29¦+¦%2B¦%2D¦;¦% 3b¦<¦%3c¦%3d¦>¦%3e¦%7c"; string[] Anysqlstr = Sqlstr.split ('¦'); foreach(stringSsinchanysqlstr) {                        if(Str.tolower (). INDEXOF (ss) >=0) {returnvalue=false;  Break; }                    }                }            }            Catch{returnvalue=false; }            returnreturnvalue; }        #endregion    }

/// <summary>    /// Filter Illegal characters     /// </summary>     Public class CheckCharPage:System.Web.UI.Page    {        protectedoverridevoid  onpreload (EventArgs e)        {            Checkchar.startprocessrequest ();        }    }

ASP. NET address SQL injection code