#region 防止代碼注入
/// <summary>
/// 防止HTML代碼注入
/// </summary>
/// <param name="NoteContent"></param>
/// <returns></returns>
public string ExchangeNote(string NoteContent)
{
string afterReContent = "";
afterReContent = NoteContent.Replace("<", "<").Replace(">", ">");
return afterReContent;
}
/// <summary>
/// 防止SQL注入
/// </summary>
/// <param name="inputStr">輸入的sql語句</param>
/// <returns>過濾後的語句</returns>
public static string No_SqlHack(string inputStr)
{
//要過濾掉的關鍵字集合
string NoSqlHack_AllStr = "|;|and|chr(|exec|insert|select|delete|from|update|mid(|master.|";
string SqlHackGet = inputStr;
string[] AllStr = NoSqlHack_AllStr.Split('|');
//分離關鍵字
string[] GetStr = SqlHackGet.Split(' ');
if (SqlHackGet != "")
{
for (int j = 0; j < GetStr.Length; j++)
{
for (int i = 0; i < AllStr.Length; i++)
{
if (GetStr[j].ToLower() == AllStr[i].ToLower())
{
GetStr[j] = "";
break;
}
}
}
SqlHackGet = "";
for (int i = 0; i < GetStr.Length; i++)
{
SqlHackGet += GetStr[i].ToString() + " ";
}
return SqlHackGet.TrimEnd(' ').Replace("'", "_").Replace(",", "_").Replace("<", "<").Replace(">", ">");
}
else
{
return "";
}
}
#endregion