php网站在检测时总是提示网站存在sql注入漏洞

1，用正则表达式过滤一些SQL注入关键字。
2，尽量使用参数形式，少用拼凑型SQL语句
3，条件可以的话，请使用存储过程操作数据库．
4，转换参数类型．如是参数是数字型，则转换成数字型的才操作
public class AntiSqlInAttack
{
public System.Web.HttpRequest request;

public AntiSqlInAttack(System.Web.HttpRequest request)
{
this.request = request;
}

public bool CheckBadQuery()
{
//整串字符对比方法
//string badword = ";|'|*|%| and |20%and20%| master |20%master20%|exec|insert|select|delete|count|chr|mid|truncate|char|declare|update";
//string query = request.ServerVariables["Query_String"].ToString();
//string[] badwordArry = badword.Split(new char[] { '|' });
//for (int i = 0; i < badwordArry.Length; i++)
//{
// string tempWord = badwordArry[i].Trim();
// if (query.IndexOf(tempWord) >= 1)
// return true;
//}
//return false;
if (request.QueryString.Count != 0)
{
for (int i = 0; i < request.QueryString.Count; i++)
{
if (CheckBadWord(request.QueryString[i].ToString()))
return true;
}
}
return false;
}

public bool CheckBadForm()
{
if (request.Form.Count > 0)
{
for (int i = 0; i < request.Form.Count; i++)
{
if (CheckBadWord(request.Form[i]))
return true;
}
}
return false;
}

public bool CheckBadWord(string str)
{
string pattern = @"select|insert|delete|from|count\(|drop table|update|truncate|asc\(|mid\(|char\(|xp_cmdshell|exec master|netlocalgroup administrators|:|net user|""|or|and";
if (Regex.IsMatch(str, pattern, RegexOptions.IgnoreCase) || Regex.IsMatch(str, @"[-|;|,|\/|\(|\)|\[|\]|\}|\{|%|@|\*|!|\']"))
return true;
return false;
}

/**//// <summary>
/// 反SQL注入
/// </summary>
public void AntiSqlInjectionAttack()
{
if (CheckBadQuery() || CheckBadForm())
{
string msg = string.Empty;
msg += "<span style='font-size:12px;'>非法操作！系统做了如下记录!<br>";
msg += "操作IP：" +Utils.GetRealIP()+ "<br>";
msg += "操作时间：" + DateTime.Now + "<br>";
msg += "页面：" + request.ServerVariables["URL"].ToLower() + "<br>";
msg += "<a href=\"#\" onclick=\"history.back()\">返回上一页</a></span>";
MessageBox.ResponseWrite(msg, true);
}
}

}

温馨提示：答案为网友推荐，仅供参考

当前网址：https://verywind.cn/ee/3vv2y2yx3.html