asp.net 防字符串注入方法(2008-08-11 11:05:03)
CODE:
#region 替换特殊字符
///
<summary>
/// 特殊字符串替换
///
</summary>
public static string repString(string
strTemp)
{
if
(strTemp == null)
strTemp = "";
strTemp =
strTemp.Replace(" ", "");
strTemp =
strTemp.Replace("*", "");
strTemp =
strTemp.Replace("?", "");
strTemp =
strTemp.Replace("#", "");
strTemp =
strTemp.Replace("@", "");
strTemp =
strTemp.Replace("^", "");
strTemp =
strTemp.Replace("&", "");
strTemp =
strTemp.Replace("+", "");
strTemp =
strTemp.Replace("-", "");
strTemp =
strTemp.Replace("(", "");
strTemp =
strTemp.Replace(")", "");
strTemp =
strTemp.Replace("!", "");
strTemp =
strTemp.Replace("`", "");
strTemp =
strTemp.Replace("~", "");
strTemp =
strTemp.Replace("<", "");
strTemp =
strTemp.Replace(">", "");
strTemp =
strTemp.Replace("'", "");
strTemp =
strTemp.Replace("\"", "");
strTemp =
strTemp.Replace("\\", "");
strTemp =
strTemp.Replace("|", "");
strTemp =
strTemp.Replace("=", "");
strTemp =
strTemp.Replace(",", "");
return
strTemp;
}
#endregion
#region 删除html格式
///
<summary>
/// 替换html特殊字符
///
</summary>
/// <param
name="strContent"></param>
///
<returns></returns>
public static string repHtml(string
strContent)
{
strContent
= strContent.Replace("&",
"&");
strContent
= strContent.Replace("´", "´´");
strContent
= strContent.Replace("<",
"<");
strContent
= strContent.Replace(">",
">");
strContent
= strContent.Replace("chr(60)", "<");
strContent
= strContent.Replace("chr(37)", ">");