在global文件中添加如下代码：
void Application_BeginRequest(object sender, EventArgs e)
{
//遍历Post参数，隐藏域除外
if (Regex.IsMatch(Request.RawUrl.ToLower(), @"/manager/")==false)
for (int i=0; i < Request.Form.Count;i++)
{
if (Request.Form[i].ToString() == "__VIEWSTATE") continue;
if (IsDanger(Request.Form[i].ToString()))
{
Response.Write("您提交的内容中含有非法字符,已经被拒绝.");
Response.End();
}
}
//过滤所有Url中的危险字符串
if (Request.QueryString.Count > 0 && Regex.IsMatch(Request.RawUrl.ToLower(), @"/. asp x") == true && Regex.IsMatch(Request.RawUrl.ToLower(), @"fckeditor") == false)//如果防止截获fckeditor正常的Url，必须验证".aspx"
{
string Temp = "";
//string Url = Request.Url.AbsoluteUri.Substring(0, Request.Url.AbsoluteUri.LastIndexOf("?"));
string Url = Request.RawUrl.Substring(0, Request.RawUrl.LastIndexOf("?"));
for (int i = 0; i < this.Request.QueryString.Count; i++)
{
try
{
Temp = HandleRequestParam(this.Request.QueryString[i].ToString());
Url += i == 0 ? "?" : "&";
Url += Request.QueryString.Keys[i].ToString() + "=" + Temp;
}
catch { }
}
//if (Url.Length < Request.Url.AbsoluteUri.Length)
// Response.Redirect(Url);
Context.RewritePath(Url);//可以用Response.Redirect和Context.RewritePath
}
//全站防止页面缓存 HdhCmsTest2cto测试数据
Response.Buffer = true;
Response.ExpiresAbsolute = DateTime.Now.AddSeconds(-1);
Response.Expires = 0;
Response.CacheControl = "no-cache";
}
protected string HandleRequestParam(string str)
{
string RetStr = "";
char[] strC = str.ToLower().ToCharArray();
for (int i = 0; i < strC.Length; i++)
{
if (Convert.ToInt32(strC[i]) >= 48 && Convert.ToInt32(strC[i]) <= 57)
RetStr += strC[i].ToString();
else
break;
}
return RetStr;
}
protected bool IsDanger(string InText)
{
string word = @"exec|insert|select|delete|update|master|truncate|char|declare|join|iframe|href|script|<|>|request";
if (InText == null)
return false;
if (Regex.IsMatch(InText,word))
return true;
return false;
}
查看更多关于.net全站过滤url危险参数，防注入 - 网站安全 -的详细内容...