关于我们

质量为本、客户为根、勇于拼搏、务实创新

< 返回新闻公共列表

万能表单防sql注入漏洞方法

发布时间:2019-11-13 11:28:32


<%@ WebHandler Language="C#"  Class="DTcms.Web.dev.zsbm" %>
using System;
using System.Collections.Generic;
using System.Web;
using System.Web.SessionState;
using System.IO;
using System.Text;
using System.Data;
using System.Data.Sql;
using System.Data.SqlClient;
using DTcms.Common;
using DTcms.DBUtility;
using NetWing.Common.Data.SQLServer;
using NetWing.Common.Request;
namespace DTcms.Web.dev
{
    /// <summary> 
    /// 展商报名 的摘要说明 
    /// </summary> 
    public class zsbm : IHttpHandler, IRequiresSessionState
    {
        public void ProcessRequest(HttpContext context)
        {
            context.Response.ContentType = "text / plain";
            //获取参数开始
 
            if (context.Request["cmd"]==""||context.Request["cmd"]!="netwingcmd")
            {
                context.Response.End();
            }
            string form_id = context.Request["fid"];
            string gsmc = context.Request["field_control_gsmc"];
            string cjzhdy = context.Request["field_control_cjzhdy"];
            string xm = context.Request["field_control_xm"];
            string zw = context.Request["field_control_zw"];
            string szgj = context.Request["field_control_szgj"];
            string szcs = context.Request["field_control_szcs"];
            string dz = context.Request["field_control_dz"];
            string dh = context.Request["field_control_dh"];
            string cz = context.Request["field_control_cz"];
            string sj = context.Request["field_control_sj"];
            string dzyx = context.Request["field_control_dzyx"];
            string yx = context.Request["field_control_yx"];
            string scshy = context.Request["field_control_scshy"];
            string czmd = context.Request["field_control_czmd"];
            string qt = context.Request["field_control_qt"];
            string ydbzzw = context.Request["field_control_ydbzzw"];
            string kd = context.Request["field_control_kd"];
            string nsrhqd = context.Request["field_control_nsrhqd"];
            string qtq = context.Request["field_control_qtq"];
            string jslj = context.Request["field_control_jslj"];
 
            //获取参数结束
            //参数方法保存到数据库
            StringBuilder sql = new StringBuilder();
            sql.Append("insert into nw_customform_user_zsbm ");
            sql.Append("(");
            sql.Append("gsmc,");
            sql.Append("cjzhdy,");
            sql.Append("xm,");
            sql.Append("zw,");
            sql.Append("szgj,");
            sql.Append("szcs,");
            sql.Append("dz,");
            sql.Append("dh,");
            sql.Append("cz,");
            sql.Append("sj,");
            sql.Append("dzyx,");
            sql.Append("yx,");
            sql.Append("scshy,");
            sql.Append("czmd,");
            sql.Append("qt,");
            sql.Append("ydbzzw,");
            sql.Append("kd,");
            sql.Append("nsrhqd,");
            sql.Append("qtq,");
            sql.Append("jslj,");
            sql.Append("form_id");
            sql.Append(")");
            sql.Append(" values(");
            sql.Append("@gsmc,");
            sql.Append("@cjzhdy,");
            sql.Append("@xm,");
            sql.Append("@zw,");
            sql.Append("@szgj,");
            sql.Append("@szcs,");
            sql.Append("@dz,");
            sql.Append("@dh,");
            sql.Append("@cz,");
            sql.Append("@sj,");
            sql.Append("@dzyx,");
            sql.Append("@yx,");
            sql.Append("@scshy,");
            sql.Append("@czmd,");
            sql.Append("@qt,");
            sql.Append("@ydbzzw,");
            sql.Append("@kd,");
            sql.Append("@nsrhqd,");
            sql.Append("@qtq,");
            sql.Append("@jslj,");
            sql.Append("@form_id)");
            sql.Append(";select @@IDENTITY");
            SqlParameter[] parameters = {
                 new SqlParameter("@gsmc",gsmc),
                         new SqlParameter("@cjzhdy",cjzhdy),
                         new SqlParameter("@xm",xm),
                         new SqlParameter("@zw",zw),
                         new SqlParameter("@szgj",szgj),
                         new SqlParameter("@szcs",szcs),
                         new SqlParameter("@dz",dz),
                         new SqlParameter("@dh",dh),
                         new SqlParameter("@cz",cz),
                         new SqlParameter("@sj",sj),
                         new SqlParameter("@dzyx",dzyx),
                         new SqlParameter("@yx",yx),
                         new SqlParameter("@scshy",scshy),
                         new SqlParameter("@czmd",czmd),
                         new SqlParameter("@qt",qt),
                         new SqlParameter("@ydbzzw",ydbzzw),
                         new SqlParameter("@kd",kd),
                         new SqlParameter("@nsrhqd",nsrhqd),
                         new SqlParameter("@qtq",qtq),
                         new SqlParameter("@jslj",jslj),
                            new SqlParameter("@form_id",form_id)
              };
            object obj = DbHelperSQL.GetSingle(sql.ToString(),parameters);
            if (obj == null)
            {
                context.Response.Write("{\"status\":0,\"msg\":\"添加失败!\"}");
            }
            else
            {
                context.Response.Write("{\"status\":" + Convert.ToInt32(obj) + ",\"msg\":\"添加成功!\"}");
            }
        }
        //校检网站验证码  
 
        public bool IsReusable
        {
            get
            {
                return false;
            }
        }
    }
}



/template/Home/Zkeys/PC/Static