Encryption and decryption of querystring in ASP. NET

 

We know that the querystring method can be used to transfer values on the two pages of ASO and net. However, it is not safe to use it, and it is a little careless, it will completely expose the transmitted information parameter value to the URL. How terrible!

 

Method 1: change the form submission method to post.

Get adds the parameter data queue to the URL referred to by the Action attribute of the submission form. The values correspond to each field in the form one by one and can be seen in the URL.

Post uses the http post mechanism to place fields in the form and their content in the HTML header and send them to the URL address referred to by the Action attribute. You cannot see this process.

 

 

Method 2: code encryption:

　

1. Sender encryption.

Response. Redirect ("detailinfo. aspx? Id = "+ convert. tobase64string (system. Text. encoding. Default. getbytes (" sp10006 "). Replace (" + "," % 2B "));
(No space in the middle)

　　

2. decrypt the receiver.

String id = system. text. encoding. default. getstring (convert. frombase64string (request. querystring ["ID"]. tostring (). replace ("+", "% 2B ")));

 

 

When using system. Convert. frombase64stringAn exception is reported during decryption: Invalid base-64 character array Length 

 

Principle:

Adding "+" in the encrypted string will change to a space "" When passing parameters, so the string will be invalid during decryption.

For example:

  Encrypted string: dn8b8fhdk6lez2uneeuzk + O/rrhbzawt

  After passing the parameter, change it to: dn8b8fhdk6lez2uneeuzk o/rrhbzawt

  Space not recognized during decryption: throwing formatexception

 

 

Solution:

In convert. tobase64string ()After EncryptionUse string. Replace ("+", "% 2B")Replace the plus sign with the encoding,

Then it is passed as a parameter to another page, so that the page will be decoded as a plus sign only when the parameter is extracted.

For example:

  Encrypted string: dn8b8fhdk6lez2uneeuzk + O/rrhbzawt

  After replacement: dn8b8fhdk6lez2uneeuzk + O/rrhbzawt

  The parameter is also passed: dn8b8fhdk6lez2uneeuzk + O/rrhbzawt

  During decryption: The Program recognizes "+" as the plus signDecrypted