爱编程 - 请求过滤
type: channel
link: https://masoft.cn/tag/请求过滤/
items: .NET网站请求过滤验证防恶意字符

.NET网站请求过滤验证防恶意字符
type: item
date: 2018-11-11T15:33:00+08:00
description: 1、Global.asax文件加入判断代码void Application_BeginRequest(object sender, EventArgs e) { string q = " 您的提交带有不合法参数,谢谢合作! 了解更多请点击:智汇科技 "; if (Request.Cookies != null) { if (WebSafe.CookieData()) { Response.Write("您提交的Cookie数据有恶意字符！"); Response.End(); } } if (Request.UrlReferrer != null) { if (WebSafe.referer()) { Response.Write("您提交的Referrer数据有恶意字符！"); Response.End(); } } if (Request.RequestType.ToUpper() == "POST") { if (WebSafe.PostData()) { Response.Write("您提交的Post数据有恶意字符！"); Response.End(); } } if (Request.RequestType.ToUpper() == "GET") { if (WebSafe.GetData()) { Response.Write("您提交的Get数据有恶意字符！"); Response.End(); } } }2、附请求过滤验证防恶意字符类库using System.Text.RegularExpressions; using System.Web; namespace Als.Utils.Net { public class WebSafe { /// /// 过滤字符 /// private const string StrRegex = @"^\+/v(8|9)|\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|<\s*img\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)"; /// /// POST请求验证 /// /// public static bool PostData() { var result = false; for (var i = 0; i < HttpContext.Current.Request.Form.Count; i++) { result = CheckData(HttpContext.Current.Request.Form[i]); if (result) { break; } } return result; } /// /// GET请求验证 /// /// public static bool GetData() { var result = false; for (var i = 0; i < HttpContext.Current.Request.QueryString.Count; i++) { result = CheckData(HttpContext.Current.Request.QueryString[i]); if (result) { break; } } return result; } /// /// 请求COOKIE验证 /// /// public static bool CookieData() { var result = false; for (var i = 0; i < HttpContext.Current.Request.Cookies.Count; i++) { result = CheckData(HttpContext.Current.Request.Cookies[i]?.Value.ToLower()); if (result) { break; } } return result; } /// /// 请求Referer验证 /// /// public static bool Referer() { return HttpContext.Current.Request.UrlReferrer != null && CheckData(HttpContext.Current.Request.UrlReferrer.ToString()); } /// /// 字符验证 /// /// /// public stati…