. Net anti-Injection

Website security is a top concern for every website developer and operator. Once a website has a vulnerability, it will inevitably cause great losses. In order to improve the security of the website, the website should first prevent injection, and the most important thing is that the security facilities of the server should be put in place.
The following describes some elements of website anti-injection.
I. Discard SQL statements and splice them directly, although it is very convenient to write.
2. If you use SQL statements, use parameterization to add Param.
Iii. Use stored procedures as much as possible, with high security and fast processing speed
4. Shielding SQL, javascript, and other injection ( Very important), It is unlikely to write each file. So we need to find a way to work on all files. I collected the following three methods online:

1. In the Web. config file, add a tag under <etettings> as follows:
<Deleetask>
<Add key = "safeParameters" value = "OrderID-int32, mermeremail-email, ShippingZipcode-USzip"/>
</AppSettings>
Key is the value after <saveParameters> is "OrderId-int32", where "-" indicates the name of the parameter, such as OrderId, and int32 indicates the data type.

2. Add the following section in Global. asax:
Protected void Application_BeginRequest (Object sender, EventArgs e ){
String [] safeParameters = System. Configuration. ConfigurationSettings. deleettings ["safeParameters"]. ToString (). Split (',');
For (int I = 0; I <safeParameters. Length; I ++ ){
String parameterName = safeParameters [I]. Split ('-') [0];
String parameterType = safeParameters [I]. Split ('-') [1];
IsValidParameter (parameterName, parameterType );
}
}

Public void isValidParameter (string parameterName, string parameterType ){
String parameterValue = Request. QueryString [parameterName];
If (parameterValue = null) return;

If (parameterType. Equals ("int32 ")){
If (! ParameterCheck. isInt (parameterValue) Response. Redirect ("parameterError. aspx ");
}
Else if (parameterType. Equals ("USzip ")){
If (! ParameterCheck. isUSZip (parameterValue) Response. Redirect ("parameterError. aspx ");
}
Else if (parameterType. Equals ("email ")){
If (! ParameterCheck. isEmail (parameterValue) Response. Redirect ("parameterError. aspx ");
}
}

Third: Use the string filter class
Using System;

Namespace web. comm
{
/** // <Summary>
/// Summary of ProcessRequest.
/// </Summary>
Public class ProcessRequest
{
Public ProcessRequest ()
{
//
// TODO: add the constructor logic here
//
}

SQL injection attack code analysis # region SQL injection attack code analysis
/** // <Summary>
/// Process user-submitted requests
/// </Summary>
Public static void StartProcessRequest ()
{

// System. Web. HttpContext. Current. Response. Write ("<script> alert ('ddddd'); </script> ");
Try
{
String getkeys = "";
// String sqlErrorPage = System. Configuration. ConfigurationSettings. deleettings ["CustomErrorPage"]. ToString ();
If (System. Web. HttpContext. Current. Request. QueryString! = Null)
{

For (int I = 0; I <System. Web. HttpContext. Current. Request. QueryString. Count; I ++)
{
Getkeys = System. Web. HttpContext. Current. Request. QueryString. Keys [I];
If (! ProcessSqlStr (System. Web. HttpContext. Current. Request. QueryString [getkeys], 0 ))
{
// System. Web. HttpContext. Current. Response. Redirect (sqlErrorPage + "? Errmsg = sqlserver & sqlprocess = true ");
System. Web. HttpContext. Current. Response. Write ("<script> alert ('do not submit it illegally! '); History. back (); </script> ");
System. Web. HttpContext. Current. Response. End ();
}
}
}
If (System. Web. HttpContext. Current. Request. Form! = Null)
{
For (int I = 0; I <System. Web. HttpContext. Current. Request. Form. Count; I ++)
{
Getkeys = System. Web. HttpContext. Current. Request. Form. Keys [I];
If (! ProcessSqlStr (System. Web. HttpContext. Current. Request. Form [getkeys], 1 ))
{
// System. Web. HttpContext. Current. Response. Redirect (sqlErrorPage + "? Errmsg = sqlserver & sqlprocess = true ");
System. Web. HttpContext. Current. Response. Write ("<script> alert ('do not submit it illegally! '); History. back (); </script> ");
System. Web. HttpContext. Current. Response. End ();
}
}
}
}
Catch
{
// Error handling: process user submitted information!
}
}
/** // <Summary>
/// Analyze whether the user request is normal
/// </Summary>
/// <Param name = "Str"> input user to submit data </param>
/// <Returns> whether SQL injection attack code is returned </returns>
Private static bool ProcessSqlStr (string Str, int type)
{
String SqlStr;

If (type = 1)
SqlStr = "exec | insert | select | delete | update | count | chr | mid | master | truncate | char | declare ";
Else
SqlStr = "'| and | exec | insert | select | delete | update | count | * | chr | mid | master | truncate | char | declare ";

Bool ReturnValue = true;
Try
{
If (Str! = "")
{
String [] anySqlStr = SqlStr. Split ('| ');
Foreach (string ss in anySqlStr)
{
If (Str. IndexOf (ss)> = 0)
{
ReturnValue = false;
}
}
}
}
Catch
{
ReturnValue = false;
}
Return ReturnValue;
}
# Endregion

}
}