Database anti-Script Injection

Website security is very important. Therefore, a website must have basic defense measures against attacks, such as script attacks, cross-origin attacks, and database injection attacks. The following describes the using System and using System used to prevent Database SQL Script Injection. collections. generic; using System. text; namespace NZS. common {public class Filter {// <summary> // checks whether dangerous characters exist (prevents SQL injection) /// </summary> /// <param name = "contents"> pre-check content </param> /// <returns> returns True or false </returns> public static bool HasSqlKeywords (string contents) {bool ReturnValue = false; if (contents. length> 0) {string LowerStr = contents. toLower (); string RxStr = @ "(/sand/s) | (/slike/s) | (select/s) | (insert/s) | (delete/s) | (update/s [/s/S]. */sset) | (create/s) | (/stable) | (<[iframe |/iframe | script |/script]) | (') | (/sexec) | (declare) | (/struncate) | (/smaster) | (/sbackup) | (/smid) | (/scount) | (cast) | (%) | (/sadd/s) | (/salter/s) | (/sdrop/s) | (/sfrom/s) | (/struncate/s) | (/sxp_cmdshell/s) "; // Match checks the keywords and special characters in the database, such as single quotes System. text. regularExpressions. regex Rx = new System. text. regularExpressions. regex (RxStr); ReturnValue = Rx. isMatch (LowerStr, 0);} return ReturnValue ;} /// <summary> /// filter the injection script in the SQL statement string /// </summary> /// <param name = "str"> input string </param >/// <returns> filtered string </returns> public static string SqlFilter (string str) {str = str. replace ("", "'' "); // Replace single quotes with two single quotes str = str. replace ("'", "'"); // Replace the half-width block with the full-width block to prevent multiple statements from executing str = str. replace (";", ";"); // Replace the half angle brackets with the full angle brackets str = str. replace ("(", "("); str = str. replace (")", "); // Replace with a regular expression, prevent uppercase/lowercase letters ///////////////////////remove the command keyword str = str for executing the stored procedure. replace ("Exec", ""); str = str. replace ("Execute", ""); // remove the system stored procedure or extended stored procedure keyword str = str. replace ("xp _", "x p _"); str = str. replace ("sp _", "s p _"); // prevents hex injection of str = str. replace ("0x", "0 x"); return str ;}}}