SQL防注入漏洞的方法

#region SQL防注入漏洞的方法

/// <summary>

/// SQL防注入漏洞的方法

/// </summary>

/// <param name="strVar"></param>

/// <returns>是否存在特定字符</returns>

public static bool IsExistSpecialCharacter(string strVar)

{

string str_In = "'|;|and|exec|insert|select|delete|update|count|*|%|char|mid|master|truncate|char|declare|--";

string[] sList = str_In.Split('|');

foreach (string s in sList)

{

if (strVar.ToLower().Contains(s))

{

return true;

}

}

return false;

}

public static string ClearSpecialCharacter(string strVar)

{

string str_In = "'|;|and|exec|insert|select|delete|update|count|*|%|char|mid|master|truncate|char|declare|--";

string[] sList = str_In.Split('|');

foreach (string s in sList)

{

strVar = strVar.Replace(s, "");

}

return strVar;

}

#endregion