. Net full-site filtering of url dangerous parameters to prevent Injection

Add the following code to the global File: void Application_BeginRequest (object sender, EventArgs e) {// traverse the Post parameter, except for if (Regex. isMatch (Request. rawUrl. toLower (), @ "/manager/") = false) for (int I = 0; I <Request. form. count; I ++) {if (Request. form [I]. toString () = "_ VIEWSTATE") continue; if (IsDanger (Request. form [I]. toString () {Response. write ("the content you submitted contains invalid characters and has been denied. "); Response. end () ;}// filter the dangerous string if (Request. quer YString. count> 0 & Regex. isMatch (Request. rawUrl. toLower (),@"/. aspx ") = true & Regex. isMatch (Request. rawUrl. toLower (), @ "fckeditor") = false) // if you want to prevent the normal fckeditor Url from being intercepted, you must verify ". aspx "{string Temp =" "; // string Url = Request. url. absoluteUri. substring (0, Request. url. absoluteUri. lastIndexOf ("? "); String Url = Request. RawUrl. Substring (0, Request. RawUrl. LastIndexOf ("? "); For (int I = 0; I <this. request. queryString. count; I ++) {try {Temp = HandleRequestParam (this. request. queryString [I]. toString (); Url + = I = 0? "? ":" & "; Url + = Request. queryString. keys [I]. toString () + "=" + Temp;} catch {}} // if (Url. length <Request. url. absoluteUri. length) // Response. redirect (Url); Context. rewritePath (Url); // Response can be used. redirect and Context. rewritePath} // the whole site prevents the page from caching www.2cto.com Response. buffer = true; Response. expiresAbsolute = DateTime. now. addSeconds (-1); Response. expires = 0; Response. cacheControl = "no-cache";} protected string HandleRequestParam (string str) {string RetStr = ""; char [] strC = str. toLower (). toCharArray (); for (int I = 0; I <strC. length; I ++) {if (Convert. toInt32 (strC [I])> = 48 & Convert. toInt32 (strC [I]) <= 57) RetStr + = strC [I]. toString (); else break;} return RetStr;} protected bool IsDanger (string InText) {string word = @ "exec | insert | select | delete | update | master | truncate | char | declare | join | iframe | href | script | <|> | request "; if (InText = null) return false; if (Regex. isMatch (InText, word) return true; return false ;}