Code to guard against SQL injection attacks

Attacking a SQL injection attack is using a design vulnerability that runs SQL commands on the target server and other forms of attack, and the failure to validate the data entered by the user when dynamically generating SQL commands is the main reason for the SQL injection attack to succeed. Like what:

If your query is a SELECT * from admin where username= ' "&user&" ' and password= ' "&pwd&" ' "

Well, if my username is: 1 ' or ' 1 ' = ' 1

So, your query will become:

SELECT * from admin where username= ' 1 or ' 1 ' = ' 1 ' and password= ' "&pwd& '"
This way your query is passed, so you can enter your admin interface.

Therefore, the user's input should be checked when guarding. Special-type special characters, such as single quotes, double quotes, semicolons, commas, colons, connection numbers, etc. are converted or filtered.

Special characters and strings that need to be filtered are:

NET user
xp_cmdshell
/add
EXEC Master.dbo.xp_cmdshell
net localgroup Administrators
Select
Count
Asc
Char
Mid
'
:
"
Insert
Delete from
drop table
Update
Truncate
From
%
Here are two of my written on the solution to the injection-type attack prevention code, for everyone to learn the reference!

JS version of the prevention of SQL injection attack code ~:

[CODE START]
<script language= "JavaScript" >
<!--
var url = location.search;
var re=/^\? (.*) (Select%20|insert%20|delete%20from%20|count\ (|drop%20table
|update%20truncate%20|asc\ (|mid\ (|char\) (|xp_cmdshell|exec%20master
|net%20localgroup%20administrators|\ "|:| Net%20user|\ ' |%20or%20) (. *) $/gi;
var e = re.test (URL);
if (e) {
Alert ("The address contains illegal characters ~");
Location.href= "error.asp";
}
-->
<script>
[CODE end]
ASP version of the prevention of SQL injection attack code ~:

[CODE START]
<%
On Error Resume Next
Dim strtemp

If LCase (Request.ServerVariables ("HTTPS") = "Off" Then
strtemp = "http://"
Else
strtemp = "https://"
End If

strtemp = strtemp & Request.ServerVariables ("SERVER_NAME")
If Request.ServerVariables ("Server_port") <> Then strtemp = strtemp & ":" & Request.ServerVariables ("SER Ver_port ")

strtemp = strtemp & Request.ServerVariables ("URL")

If Trim (request.querystring) <> "" Then strtemp = strtemp & "?" & Trim (Request.QueryString)

strtemp = LCase (strtemp)

If Instr (strtemp, "select%20") or Instr (strtemp, "insert%20") or Instr (strtemp, "Delete%20from") or Instr (strtemp, "Count (") or Instr (strtemp," drop%20table ") or Instr (strtemp," update%20 ") or Instr (strtemp," truncate%20 ") or Instr (strtemp," ASC (") or Instr (strtemp, Mid () or INSTR (strtemp," char (") or Instr (strtemp," xp_cmdshell ") or Instr (strtemp," exec% ") 20master ") or Instr (strtemp," net%20localgroup%20administrators ") or Instr (strtemp,": ") or Instr (strtemp," Net%20user " ) or Instr (strtemp, "'") or Instr (strtemp, "%20or%20") Then
Response.Write "<script language= ' JavaScript '"
Response.Write "Alert (' Illegal address!!) ');"
Response.Write "location.href= ' error.asp ';"
Response.Write "<script>"
End If
%>
[CODE end]
C # Check string, anti-SQL injection attack

This example is tentatively = number and ' number.

BOOL Checkparams (params object[] args)
{
String[] lawlesses={"=", "'"};
if (lawlesses==null| | lawlesses.length<=0) return true;
Constructs a regular expression, example: lawlesses is an = number and ' number, and the regular expression is. *[=} '].* (see MSDN for Regular expression related content)
In addition, because I want to do general and easy to modify the function, so more than one step from the character array to the regular expression, in actual use, directly write regular expressions can also;

String str_regex= ". *[";
for (int i=0;i< lawlesses.length-1;i++)
str_regex+=lawlesses[i]+ "|";
str_regex+=lawlesses[lawlesses.length-1]+ "].*";
//
foreach (object arg in args)
{
if (arg is string)//If it is a string, check directly
{
If Regex.Matches (Arg. ToString (), Str_regex). COUNT&GT;0)
return false;
}
else if (Arg is ICollection)
If it is a collection, check that the elements in the collection are strings and are strings.
{
foreach (Object obj in (ICollection) Arg)
{
if (obj is string)
{
If Regex.Matches (obj. ToString (), Str_regex). COUNT&GT;0)
return false;
}
}
}
}
return true;