SQL Injection prevention solution after. net is encapsulated

The website was accidentally recruited. I sorted out a simple anti-injection method on the Internet and shared it with you.
Web. config file call
Place SqlInPost. cs in the app_code directory:
SqlInPost. cs
Using System;
Using System. Data;
Using System. Configuration;
Using System. Web;
Using System. Web. Security;
Using System. Web. UI;
Using System. Web. UI. WebControls;
Using System. Web. UI. WebControls. WebParts;
Using System. Web. UI. HtmlControls;
Using System. Text. RegularExpressions;
Using System. Collections. Specialized;
Namespace SqlIn
{
///
/// Summary of SqlInPost
///
 
Public class SqlInPost: IHttpHandlerFactory
{
Public SqlInPost ()
{
//
// TODO: add the constructor logic here
//
}
Public virtual IHttpHandler GetHandler (HttpContext context, string requestType, string url, string pathTranslated)
{
// Get the compilation instance (through reflection)
PageHandlerFactory factory = (PageHandlerFactory) Activator. CreateInstance (typeof (PageHandlerFactory), true );
IHttpHandler handler = factory. GetHandler (context, requestType, url, pathTranslated );
// Filter strings
If (requestType = "POST ")
{
Page page = handler as Page;
If (page! = Null)
Page. PreLoad + = new EventHandler (FilterStrFactoryHandler_PreLoad );
}
If (requestType = "GET ")
{
Page page = handler as Page;
If (page! = Null)
Page. PreLoad + = new EventHandler (FilterStrFactoryHandler_PreLoad1 );
}
// Return
Return handler;
}
// Filter special characters in TextBox, Input, and Textarea
Void FilterStrFactoryHandler_PreLoad (object sender, EventArgs e)
{
Try
{
Page page = sender as Page;
NameValueCollection postData = page. Request. Form;
Foreach (string postKey in postData)
{
Control ctl = page. FindControl (postKey );
If (ctl as TextBox! = Null)
{
(TextBox) ctl). Text = Common. InputText (TextBox) ctl). Text );
Continue;
}
If (ctl as HtmlInputControl! = Null)
{
(HtmlInputControl) ctl). Value = Common. InputText (HtmlInputControl) ctl). Value );
Continue;
}
If (ctl as HtmlTextArea! = Null)
{
(HtmlTextArea) ctl). Value = Common. InputText (HtmlTextArea) ctl). Value );
Continue;
}
}
}
Catch {}
}
// Filter QueryString
Void FilterStrFactoryHandler_PreLoad1 (object sender, EventArgs e)
{
Try
{
Page page = sender as Page;
NameValueCollection QueryNV = page. Request. QueryString;
Bool isSafe = true;
For (int I = 0; I <QueryNV. Count; I ++) {if (! IsSafeString (QueryNV. Get (I) {isSafe = false; break ;}} if (! IsSafe) {page. Response. Write ("illegal value transfer! "); Page. response. end () ;}} catch {}} public virtual void ReleaseHandler (IHttpHandler handler) {}// determine whether the security string is public bool IsSafeString (string p) {bool ret = true; string [] UnSafeArray = new string [22]; UnSafeArray [0] = "'"; UnSafeArray [1] = "xp_mongoshell"; UnSafeArray [2] = "exec master. dbo. xp_cmdshell "; UnSafeArray [3] =" net localgroup administrators "; UnSafeArray [4] =" delete from "; UnSafeArray [5] =" net user "; unSafeArray [6] = "/add"; UnSafeArray [7] = "drop table"; UnSafeArray [8] = "update"; UnSafeArray [9] = "select "; unSafeArray [10] = "; and"; UnSafeArray [11] = "; exec"; UnSafeArray [12] = "; create"; UnSafeArray [13] = "; insert "; unSafeArray [14] = "and"; UnSafeArray [15] = "exec"; UnSafeArray [16] = "create"; UnSafeArray [17] = "insert "; unSafeArray [18] = "master. dbo "; UnSafeArray [19] ="; -- "; UnSafeArray [20] =" -- "; UnSafeArray [21] =" 1 = "; foreach (string s in UnSafeArray) {if (p. toLower (). indexOf (s)>-1)
{
Ret = false;
Break;
}
}
Return ret;
}
}
Public class Common
{
Public static string InputText (string text)
{
Text = text. Trim ();
If (string. IsNullOrEmpty (text ))
Return string. Empty;
Text = Regex. Replace (text, "[s] {2,}", ""); // two or more spaces
 
Text = Regex. Replace (text, "() + | ()", "n ");//
Text = Regex. replace (text, "(s * & [n | N] [B | B] [s | S] [p | P]; s *) + ",""); //
Text = Regex. Replace (text, "", string. Empty); // any other tags
Text = text. Replace ("'","''");
Text = text. Replace ("xp_cmdshell ","");
Text = text. Replace ("exec master. dbo. xp_mongoshell ","");
Text = text. Replace ("net localgroup administrators ","");
Text = text. Replace ("delete from ","");
Text = text. Replace ("net user ","");
Text = text. Replace ("/add ","");
Text = text. Replace ("drop table ","");
Text = text. Replace ("update ","");
Return text;
}
}
}