Website Security: C # Implementation of Anti-SQL Injection code

Website security is a top concern for every website developer and operator. Once a website has a vulnerability, it will inevitably cause great losses. In order to improve the security of the website, the website should first prevent injection, and the most important thing is that the security facilities of the server should be put in place.

The following describes some elements of website anti-injection.

I. Discard SQL statements and splice them directly, although it is very convenient to write.

2. If you use SQL statements, use parameterization to add Param.

Iii. Use stored procedures as much as possible, with high security and fast processing speed

4. Blocking SQL, javascript, and other injections (very important) is unlikely to be written to each file. So we need to find a way to work on all files. I collected the following three methods online:

C # anti-SQL injection method 1

In the Web. config file, add a tag under <etettings> as follows:

 
 

  
  
< appSettings> 
  
  
< add key="safeParameters" value="OrderID-int32,CustomerEmail-email,ShippingZipcode-USzip" /> 
  
  
< /appSettings>  
 
 

Key is the value after <saveParameters> is "OrderId-int32", where "-" indicates the name of the parameter, such as OrderId, and int32 indicates the data type.

C # SQL Injection prevention method 2

Add the following section to Global. asax:

 
 

  
  
protected void Application_BeginRequest(Object sender, EventArgs e){ 
  
  
String[] safeParameters = System.Configuration.ConfigurationSettings.AppSettings["safeParameters"].ToString().Split(','); 
  
  
for(int i= 0 ;i <   safeParameters.Length; i++){ 
  
  
String parameterName = safeParameters[i].Split('-')[0]; 
  
  
String parameterType = safeParameters[i].Split('-')[1]; 
  
  
isValidParameter(parameterName, parameterType); 
  
  
} 
  
  
} 
  
  
 
  
  
public void isValidParameter(string parameterName, string parameterType){ 
  
  
string parameterValue = Request.QueryString[parameterName]; 
  
  
if(parameterValue == null) return; 
  
  
 
  
  
if(parameterType.Equals("int32")){ 
  
  
if(!parameterCheck.isInt(parameterValue)) Response.Redirect("parameterError.aspx"); 
  
  
} 
  
  
else if (parameterType.Equals("USzip")){ 
  
  
if(!parameterCheck.isUSZip(parameterValue)) Response.Redirect("parameterError.aspx"); 
  
  
} 
  
  
else if (parameterType.Equals("email")){ 
  
  
if(!parameterCheck.isEmail(parameterValue)) Response.Redirect("parameterError.aspx"); 
  
  
} 
  
  
}  
 
 

C # anti-SQL Injection Method3.

Use string filter class

 
 

  
  
Using System;
  
  
 
  
  
Namespace web. comm
  
  
{
  
  
/** // <Summary>
  
  
/// Summary of ProcessRequest.
  
  
/// </Summary>
  
  
Public class ProcessRequest
  
  
{
  
  
Public ProcessRequest ()
  
  
{
  
  
//
  
  
// TODO: add the constructor logic here
  
  
//
  
  
}
  
  
 
  
  
SQL injection attack code analysis # region SQL injection attack code analysis
  
  
/** // <Summary>
  
  
/// Process user-submitted requests
  
  
/// </Summary>
  
  
Public static void StartProcessRequest ()
  
  
{
  
  

  
  
// System. Web. HttpContext. Current. Response. Write ("<script> alert ('ddddd'); </script> ");
  
  
Try
  
  
{
  
  
String getkeys = "";
  
  
// String sqlErrorPage = System. Configuration. ConfigurationSettings. deleettings ["CustomErrorPage"]. ToString ();
  
  
If (System. Web. HttpContext. Current. Request. QueryString! = Null)
  
  
{
  
  

  
  
For (int I = 0; I <System. Web. HttpContext. Current. Request. QueryString. Count; I ++)
  
  
{
  
  
Getkeys = System. Web. HttpContext. Current. Request. QueryString. Keys [I];
  
  
If (! ProcessSqlStr (System. Web. HttpContext. Current. Request. QueryString [getkeys], 0 ))
  
  
{
  
  
// System. Web. HttpContext. Current. Response. Redirect (sqlErrorPage + "? Errmsg = sqlserver & sqlprocess = true ");
  
  
System. Web. HttpContext. Current. Response. Write ("<script> alert ('do not submit it illegally! '); History. back (); </script> ");
  
  
System. Web. HttpContext. Current. Response. End ();
  
  
}
  
  
}
  
  
}
  
  
If (System. Web. HttpContext. Current. Request. Form! = Null)
  
  
{
  
  
For (int I = 0; I <System. Web. HttpContext. Current. Request. Form. Count; I ++)
  
  
{
  
  
Getkeys = System. Web. HttpContext. Current. Request. Form. Keys [I];
  
  
If (! ProcessSqlStr (System. Web. HttpContext. Current. Request. Form [getkeys], 1 ))
  
  
{
  
  
// System. Web. HttpContext. Current. Response. Redirect (sqlErrorPage + "? Errmsg = sqlserver & sqlprocess = true ");
  
  
System. Web. HttpContext. Current. Response. Write ("<script> alert ('do not submit it illegally! '); History. back (); </script> ");
  
  
System. Web. HttpContext. Current. Response. End ();
  
  
}
  
  
}
  
  
}
  
  
}
  
  
Catch
  
  
{
  
  
// Error handling: process user submitted information!
  
  
}
  
  
}
  
  
/** // <Summary>
  
  
/// Analyze whether the user request is normal
  
  
/// </Summary>
  
  
/// <Param name = "Str"> input user to submit data </param>
  
  
/// <Returns> whether SQL injection attack code is returned </returns>
  
  
Private static bool ProcessSqlStr (string Str, int type)
  
  
{
  
  
String SqlStr;
  
  
 
  
  
If (type = 1)
  
  
SqlStr = "exec | insert | select | delete | update | count | chr | mid | master | truncate | char | declare ";
  
  
Else
  
  
SqlStr = "'| and | exec | insert | select | delete | update | count | * | chr | mid | master | truncate | char | declare ";
  
  
 
  
  
Bool ReturnValue = true;
  
  
Try
  
  
{
  
  
If (Str! = "")
  
  
{
  
  
String [] anySqlStr = SqlStr. Split ('| ');
  
  
Foreach (string ss in anySqlStr)
  
  
{
  
  
If (Str. IndexOf (ss)> = 0)
  
  
{
  
  
ReturnValue = false;
  
  
}
  
  
}
  
  
}
  
  
}
  
  
Catch
  
  
{
  
  
ReturnValue = false;
  
  
}
  
  
Return ReturnValue;
  
  
}
  
  
# Endregion
  
  
 
  
  
}
  
  
}