Prevention of SQL injection attacks _ related skills

Like what:
If your query statement is select * from admin where username= "&user&" and password= "&pwd&" "
Well, if my username is: 1 or 1=1
So, your query will become:
SELECT * from admin where username=1 or 1=1 and password= "&pwd&"
This way your query is passed, so you can enter your admin interface.
Therefore, the user's input should be checked when guarding. Special-type special characters, such as single quotes, double quotes, semicolons, commas, colons, connection numbers, etc. are converted or filtered.
Special characters and strings that need to be filtered are:
NET user
xp_cmdshell
/add
EXEC Master.dbo.xp_cmdshell
net localgroup Administrators
Select
Count
Asc
Char
Mid
　　
:
"
Insert
Delete from
drop table
Update
Truncate
From
%
The following to solve the injection-type attack prevention code, for everyone to learn the reference!
JS version of the prevention of SQL injection Attack code:
　　
<script language= "JavaScript" >
<!--
var url = location.search;
var re=/^\? (.*) (Select%20|insert%20|delete%20from%20|count\ (|drop%20table|update%20truncate%20|asc\ (|mid\ |char\ (|xp_cmdshell |exec%20master|net%20localgroup%20administrators|\ "|:| NET%20USER|\|%20OR%20) (. *) $/gi;
var e = re.test (URL);
if (e) {
Alert ("The address contains illegal characters ~");
Location.href= "error.asp";
}
-->
<script>
ASP version of the prevention of SQL injection attack code ~:
[CODE START]
<%
On Error Resume Next
Dim strtemp
If LCase (Request.ServerVariables ("HTTPS") = "Off" Then
strtemp = "http://"
Else
strtemp = "https://"
End If
strtemp = strtemp & Request.ServerVariables ("SERVER_NAME")
If Request.ServerVariables ("Server_port") <> Then strtemp = strtemp & ":" & Request.ServerVariables ("SER Ver_port ")
strtemp = strtemp & Request.ServerVariables ("URL")
If Trim (request.querystring) <> "" Then strtemp = strtemp & "?" & Trim (Request.QueryString)
strtemp = LCase (strtemp)
If Instr (strtemp, "select%20") or Instr (strtemp, "insert%20") or Instr (strtemp, "Delete%20from") or Instr (strtemp, "Count (") or Instr (strtemp," drop%20table ") or Instr (strtemp," update%20 ") or Instr (strtemp," truncate%20 ") or Instr (strtemp," ASC (") or Instr (strtemp, Mid () or INSTR (strtemp," char (") or Instr (strtemp," xp_cmdshell ") or Instr (strtemp," exec% ") 20master ") or Instr (strtemp," net%20localgroup%20administrators ") or Instr (strtemp,": ") or Instr (strtemp," Net%20user " ) or Instr (strtemp, "") or Instr (strtemp, "%20or%20") Then
Response.Write "<script language=javascript>"
Response.Write "Alert (illegal address!!) );"
Response.Write "location.href=error.asp;"
Response.Write "<script>"
End If
%>
[CODE end]
C # Check string, anti-SQL injection attack
This example is tentatively = number and number.
BOOL Checkparams (params object[] args)
{
String[] lawlesses={"=", ""};
if (lawlesses==null| | lawlesses.length<=0) return true;
Constructs a regular expression, example: lawlesses is an = number and number, and the regular expression is. *[=}].* (see MSDN for Regular expression content)
In addition, because I want to do general and easy to modify the function, so more than one step from the character array to the regular expression, in actual use, directly write regular expressions can also;
String str_regex= ". *[";
for (int i=0;i< lawlesses.length-1;i++)
str_regex+=lawlesses[i]+ "|";
str_regex+=lawlesses[lawlesses.length-1]+ "].*";
//
foreach (object arg in args)
{
if (arg is string)//If it is a string, check directly
{
If Regex.Matches (Arg. ToString (), Str_regex). COUNT&GT;0)
return false;
}
else if (Arg is ICollection)//If it is a collection, check that the elements in the collection are strings and are strings.
{
foreach (Object obj in (ICollection) Arg)
{
if (obj is string)
{
If Regex.Matches (obj. ToString (), Str_regex). COUNT&GT;0)
return false;
}
}
}
}
return true;
Fill in Add:
Using Html.encode to avoid JavaScript injection attacks