Use HttpModule to prevent database Injection

Identify whether SQL injection attack code exists through corresponding keywords

String SqlStr = "and | exec | insert | select | delete | update | count | * | chr | mid | master | truncate | char | declare ";

In the following code, you should refer to the above definition, which is actually the key word to be recognized.

However, we usually process requests through the Request. QueryString/Request. Form

We can write a class to process these requests. However, if this class is loaded for processing in every processing stage, it is too troublesome.

If you write an ISAPI, you can also implement this function, but in. in NET, HttpModule helps us implement functions similar to ISAPI Filter, so it is best to use HttpModule to handle these tasks.

We only need to register the BeginRequest event.

 

REM filter string
Dim strFilter As String = "and | exec | insert | select | delete | update | count | * | chr | mid | master | truncate | char | declare | &"
Filter string array after REM Segmentation
Dim strf () As String
Dim strTemp1, strTemp2 As String
Strf = strFilter. Split ("| ")

If Request. RequestType = "GET" Then
For Each strTemp1 In Request. QueryString
For Each strTemp2 In strf
If InStr (LCase (strTemp1), LCase (strTemp2), CompareMethod. Text) Then
Response. Write ("what do you want? Don't note me! QQ with vulnerability notification: 26242000 ")
Response. End ()
End If
Next
Next
ElseIf Request. RequestType = "POST" Then
For Each strTemp1 In Request. Form
For Each strTemp2 In strf
If InStr (LCase (strTemp1), LCase (strTemp2), CompareMethod. Text) Then
Response. Write ("what do you want? Don't note me! QQ with vulnerability notification: 26242000 ")
Response. End ()
End If
Next
Next
End If

Let's take a look at the SQL attack protection code I found on Baidu.

 

// @ Copyright S. Sams Lifexperience http://blog.8see.net/
Using System;

Namespace Theme. Services. Public
{
/// <Summary>
/// Summary of SqlstrAny.
/// </Summary>
Public class ProcessRequest
{
Public ProcessRequest ()
{
//
// TODO: add the constructor logic here
//
}

# Region SQL injection attack code analysis
/// <Summary>
/// Process user-submitted requests
/// </Summary>
Public void StartProcessRequest ()
{
Try
{
String getkeys = "";
String sqlErrorPage = System. Configuration. ConfigurationSettings. AppSettings ["CustomErrorPage"]. ToString ();
If (System. Web. HttpContext. Current. Request. QueryString! = Null)
{

For (int I = 0; I <System. Web. HttpContext. Current. Request. QueryString. Count; I ++)
{
Getkeys = System. Web. HttpContext. Current. Request. QueryString. Keys [I];
If (! ProcessSqlStr (System. Web. HttpContext. Current. Request. QueryString [getkeys])
{
System. Web. HttpContext. Current. Response. Redirect (sqlErrorPage + "? Errmsg = sqlserver & sqlprocess = true ");
System. Web. HttpContext. Current. Response. End ();
}
}
}
If (System. Web. HttpContext. Current. Request. Form! = Null)
{
For (int I = 0; I <System. Web. HttpContext. Current. Request. Form. Count; I ++)
{
Getkeys = System. Web. HttpContext. Current. Request. Form. Keys [I];
If (! ProcessSqlStr (System. Web. HttpContext. Current. Request. Form [getkeys])
{
System. Web. HttpContext. Current. Response. Redirect (sqlErrorPage + "? Errmsg = sqlserver & sqlprocess = true ");
System. Web. HttpContext. Current. Response. End ();
}
}
}
}
Catch
{
// Error handling: process user submitted information!
}
}
/// <Summary>
/// Analyze whether the user request is normal
/// </Summary>
/// <Param name = "Str"> input user to submit data </param>
/// <Returns> whether SQL injection attack code is returned </returns>
Private bool ProcessSqlStr (string Str)
{
Bool ReturnValue = true;
Try
{
If (Str! = "")
{
String SqlStr = "and | exec | insert | select | delete | update | count | * | chr | mid | master | truncate | char | declare ";
String [] anySqlStr = SqlStr. Split (| );
Foreach (string ss in anySqlStr)
{
If (Str. IndexOf (ss)> = 0)
{
ReturnValue = false;
}
}
}
}
Catch
{
ReturnValue = false;
}
Return ReturnValue;
}
# Endregion

}
}

// System. Configuration. ConfigurationSettings. deleetask[ "CustomErrorPage"]. ToString (); the address of the custom error page prompt,
// Add a CustomErrorPage in the Web. Config file.
// <! -- Custom address on the error page to prevent SQL database injection attacks -->
// <Add key = "CustomErrorPage" value = "../Error.html"/>