别的博客抄过来的工具方法
作者：互联网
/// <summary>
/// 过滤SQL语句,防止注入
/// </summary>
/// <param name="strSql"></param>
/// <returns>0 - 没有注入, 1 - 有注入 </returns>
public int filterSql(string sSql)
{
int srcLen, decLen = 0;
sSql = sSql.ToLower().Trim();
srcLen = sSql.Length;
sSql = sSql.Replace("exec", "");
sSql = sSql.Replace("delete", "");
sSql = sSql.Replace("master", "");
sSql = sSql.Replace("truncate", "");
sSql = sSql.Replace("declare", "");
sSql = sSql.Replace("create", "");
sSql = sSql.Replace("xp_", "no");
decLen = sSql.Length;
if (srcLen == decLen) return 0; else return 1;
}
<script language="javascript">
<!--
var url = location.search;
var re=/^\?(.*)(select%20|insert%20|delete%20from%20|count\(|drop%20table|update%20truncate%20|asc\(|mid\(|char\(|xp_cmdshell|exec%20master|net%20localgroup%20administrators|\"|:|net%20user|\|%20or%20)(.*)$/gi;
var e = re.test(url);
if(e) {
alert("地址中含有非法字符～");
location.href="error.asp";
}
//-->
<script>
|
标签：20,sSql,抄过来,博客,Replace,decLen,var,srcLen,工具 来源： https://www.cnblogs.com/dgZhou/p/15024076.html