防止JS注入

再在Global文件里里加入    protected void Application_BeginRequest(Object sender, EventArgs e)    {    //SQL防注入    string Sql_1 = "exec|insert+|select+|delete+|update+|count|chr|mid|master+|truncate|char|declare|drop+|drop+table|creat+|creat+table";    string Sql_2 = "exec+|insert|insert+|delete+|update+|count(|count+|chr+|+mid(|+mid+|+master+|truncate+|char+|+char(|declare+|drop+|creat+|drop+table|creat+table";    string[] sql_c = Sql_1.Split('|');    string[] sql_c1 = Sql_2.Split('|');

   if (Request.QueryString != null)    {    foreach (string sl in sql_c)    {    if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= 0)    {    Response.Write("警告！你的IP已经被记录!不要使用敏感字符！");//    Response.Write(sl);    Response.Write(Request.QueryString.ToString());    Response.End();    break;    }    }    }

   if (Request.Form.Count > 0)    {    string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称    if (Request.ServerVariables["HTTP_REFERER"] != null)    {    string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称    string s3 = "";    if (s1.Length > (s2.Length - 7))    {    s3 = s2.Substring(7);    }    else    {    s3 = s2.Substring(7, s1.Length);    }    if (s3 != s1)    {    Response.Write("警告！你的IP已经被记录!不要使用敏感字符！");//    Response.End();    }    }    }    }

  b.对参数进行SQL防止注入判断   public static string SafeSqlLiteral(string inputSQL)   {    // check incoming parameters for null or blank string    if ((inputString != null) && (inputString != String.Empty))    {    inputString = inputString.Trim();

                  inputString = Regex.Replace(inputString, "[//s]{2,}", " "); //two or more spaces                  inputString = Regex.Replace(inputString, "(<[b|B][r|R]/*>)+|(<[p|P](.|//n)*?>)", "/n"); //<br>                  inputString = Regex.Replace(inputString, "(//s*&[n|N][b|B][s|S][p|P];//s*)+", " "); //&nbsp;                  inputString = Regex.Replace(inputString, "<(.|//n)*?>", string.Empty); //any other tags                  inputString = inputString.Replace("'", "''");

                  return inputString;   }   else    return inputString;   }

  c.彻底杜绝SQL注入

   1.不要使用sa用户连接数据库    2、新建一个public权限数据库用户，并用这个用户访问数据库    3、[角色]去掉角色public对sysobjects与syscolumns对象的select访问权限    4、[用户]用户名称-> 右键－属性－权限－在sysobjects与syscolumns上面打“×”    5、通过以下代码检测（失败表示权限正确，如能显示出来则表明权限太高）：    DECLARE @T varchar(255),    @C varchar(255)    DECLARE Table_Cursor CURSOR FOR    Select a.name,b.name from sysobjects a,syscolumns b    where a.id=b.id and a.xtype= 'u ' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)    OPEN Table_Cursor    FETCH NEXT FROM Table_Cursor INTO @T,@C    WHILE(@@FETCH_STATUS=0)    BEGIN print @c    FETCH NEXT FROM Table_Cursor INTO @T,@C    END    CLOSE Table_Cursor    DEALLOCATE Table_Cursor

   sql2005做法：   1、在系统视图找到sysobjects a,syscolumns b ，属性，进入权限，找到SELECT后面拒绝打勾即可。