Detection of SQL injection attack code under ASP.

Two classes:
(page data check Class) PageValidate.cs basic general.
The code is as follows:

Use the system;
Use System.Text;
The use of system.web;
Use System.Web.UI.WebControls;
Use System.Text.RegularExpressions;
Namespaces commonly used
{
///
Page data Check class
///
public class Pagevalidate
{
private static Regular Expression Regnumber = new Regular Expression ("^ [0-9] + $");
private static Regular Expression regnumbersign = new Regular Expression ("^ [+-] [0-9] + $? ”）;
private static Regular Expression Regdecimal = new Regular Expression ("[]"? ^ [0-9] + [0-9] + $ ");
private static Regular Expression regdecimalsign = new Regular Expression ("^ [+-] [0-9] + [0-9] + $?" []？ ”）; Equivalent to ^ [+-] \ D + \ D + $? []
private static Regular Expression Regemail = new Regular Expression ("^ [\ \ \-] + @ \ \ w-] + \ \ (COM | network | organization | EDU | secret | tv | BIZ | information) $ "); W¯¯ A string of English letters or numbers, as in [a-za-z0-9] syntax
private static Regular Expression regchzn = new Regular Expression ("[\ u4e00-\ U9fa5]");
Public Pagevalidate ()
{
}

# Region Numeric String check
///
Check the key value of the request query string, whether it is a number, maximum length limit
///
Request
The requested key value
/Maximum length
Returns the request query string
public static string Fetchinputdigit (req's HttpRequest, String Inputkey,maxlen interpretation)
{
String = String.Empty of the retval;
if (Inputkey = NULL && inputkey = string.empty! ）
{
retval = req. QueryString [Inputkey]
if (empty = = retval)
retval = req. Form [Inputkey]
if (empty = retval!) ）
{
retval = SQLText (retval, MaxLen);
if (Isnumber (retval)! ）
retval = of the String.Empty;
}
}
if (retval = = NULL)
retval = of the String.Empty;
Returning to RetVal;
}
///
Whether the numeric string
///
Input string
///
public static Boolean Isnumber (String inputdata)
{
Match m = Regnumber.match (Inputdata);
Returns M. Success;
}
///
Whether a numeric string can be signed with a positive sign
///
Input string
///
public static Boolean isnumbersign (String inputdata)
{
Match m = Regnumbersign.match (Inputdata);
Returns M. Success;
}
///
Whether it is a floating point number
///
Input string
///
public static Boolean Isdecimal (String inputdata)
{
Match m = Regdecimal.match (Inputdata);
Returns M. Success;
}
///
Whether it is a floating-point number with a positive sign
///
Input string
///
public static Boolean isdecimalsign (String inputdata)
{
Match m = Regdecimalsign.match (Inputdata);
Returns M. Success;
}
#endregion
# Regional Chinese detection
///
Detects if there is a Chinese character
///
///
///
public static Boolean ISHASCHZN (String inputdata)
{
Match m = Regchzn.match (Inputdata);
Returns M. Success;
}
#endregion
# Regional Mailing Address
///
Whether it is a floating-point number with a positive sign
///
Input string
///
public static Boolean Isemail (String inputdata)
{
Match m = regemail.match (input data);
Returns M. Success;
}
#endregion
# Other areas
///
Checks the maximum length of a string, returns a string of the specified length
///
Input string
Maximum length
///
public static string SQLText (sqlinput,int maximum length of the string)
{
if (sqlinput = NULL && = Sqlinput = String.Empty)!
{
Sqlinput = Sqlinput.trim ();
if (sqlinput.length> maximum length)//intercept string by maximum length
Sqlinput = sqlinput.substring (0, maximum length);
}
Return of the Sqlinput;
}
///
String encoding
///
///
///
HTMLEncode of public static strings (string inputdata)
{
Return to Httputility.htmlencode (Inputdata);
}
///
Set the label to display the encoded string
///
///
///
public static Invalid SetLabel (tag lbl, string txtinput)
{
LbL. Text = HTMLEncode (txtinput);
}
public static Invalid SetLabel (LBL tag, object inputobj)
{
SetLabel (Lbl,inputobj.tostring ());
}
String cleanup
Inputtext of public static strings (string inputstring,int maximum length)
{
RetVal of the StringBuilder = new StringBuilder ();
Check whether it is empty
if ((inputstring = NULL) && (inputstring = String.Empty)! ）
{
InputString = Inputstring.trim ();
Check length
if (inputstring.length> maximum length)
inputstring = inputstring.substring (0, maximum length);
Replace dangerous characters
for (int i = 0; I <inputString.Length; i + +)
{
Switch (inputstring [I])
{
Case ' ":
Retval.append ("" ");
Break
Case ' < ':
Retval.append ("<");
Break
Case ' > ':
Retval.append (">");
Break
Default:
Retval.append (inputstring [I]);
Break
}
}
Retval.replace ("'", "" "); Replace single quotation marks
}
Return to Retval.tostring ();
}
///
Convert to HTML code
///
String
String
public static string encoding (String str)
{
Channel = str. Replace ("&", "&");
Channel = str. Replace ("'", "'");
Channel = str. Replace ("\" "," "");
Channel = str. Replace ("", "");
Channel = str. Replace ("<", "<");
Channel = str. Replace (">", ">");
Channel = str. Replace ("\ n", "
”）;
return to the Strait;
}
///
Parse HTML into normal text
///
String
String
public static string decoding (String str)
{
Channel = str. Replace ("
"," \ n ");
Channel = str. Replace (">", ">");
Channel = str. Replace ("<", "<");
Channel = str. Replace ("", "");
Channel = str. Replace ("", "\" ");
return to the Strait;
}
#endregion
}
}

Common file (global.asax), save the Global.asax file name to the site root Trojan can be. (Other functions are self-reinforcing)

