DS7/DSWeb/Areas/SoftMng/Common/Common.cs

using System;
using System.IO;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Text.RegularExpressions;
using System.Web;
using ICSharpCode.SharpZipLib.Zip;

// ReSharper disable once CheckNamespace
namespace DSWeb.SoftMng.Common
{
    public class Common
    {
        /// <summary>
        ///SQL注入过滤
        /// </summary>
        /// <param name="source">要过滤的字符串</param>
        /// <returns>如果参数存在不安全字符，则返回true</returns>
        public static bool SqlFilterExist(string source)
        {
            string pattern = @"(insert|(?<!is)delete(?!(?<=isdelete))|database|(?<=[\p{L}\p{N}_])\bgo\b(?=[\p{L}\p{N}_])|(?<!\s)\bgo\b(?!\s)(?:(?!\r?\n).)*|(?<=\r?\n)\bgo\b(?:(?!\r?\n).)*(?=\r?\n)|\bgo\b(?=(?:(?!\r?\n).)*\s*$)|db_name|sys.|exec|create|grant|revoke|alter|execute|drop|openrowset|drop table|update|truncate|asc\(|mid\(|char\(|xp_cmdshell|netlocalgroup administrators|net user|exec|database|declare)([\s+.*]|$)";
            if (Regex.IsMatch(source, pattern, RegexOptions.IgnoreCase))
                return true;
            return false;
        }
        /// <summary>
        /// 过滤SQL字符。
        /// </summary>
        /// <param name="str">要过滤SQL字符的字符串。</param>
        /// <returns>已过滤掉SQL字符的字符串。</returns>
        public static string ReplaceSqlChar(string str)
        {
            if (str == String.Empty)
                return String.Empty; str = str.Replace("'", "‘");
            str = str.Replace(";", "；");
            str = str.Replace(",", ",");
            str = str.Replace("?", "?");
            str = str.Replace("<", "＜");
            str = str.Replace(">", "＞");
            str = str.Replace("(", "(");
            str = str.Replace(")", ")");
            str = str.Replace("@", "＠");
            str = str.Replace("=", "＝");
            str = str.Replace("+", "＋");
            str = str.Replace("*", "＊");
            str = str.Replace("&", "＆");
            str = str.Replace("#", "＃");
            str = str.Replace("%", "％");
            str = str.Replace("$", "￥");
            return str;
        }
        /// <summary>
        /// 过滤标记
        /// </summary>
        /// <param name="htmlstring">包括HTML，脚本，数据库关键字，特殊字符的源码 </param>
        /// <returns>已经去除标记后的文字</returns>
        public static string SqlFilterNoHtml(string htmlstring)
        {
            //删除脚本
            htmlstring = Regex.Replace(htmlstring, @"<script[^>]*?>.*?</script>", "", RegexOptions.IgnoreCase);
            //删除HTML
            htmlstring = Regex.Replace(htmlstring, @"<(.[^>]*)>", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"([\r\n])[\s]+", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"-->", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"<!--.*", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(quot|#34);", "\"", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(amp|#38);", "&", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(lt|#60);", "<", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(gt|#62);", ">", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(nbsp|#160);", " ", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(iexcl|#161);", "\xa1", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(cent|#162);", "\xa2", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(pound|#163);", "\xa3", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&(copy|#169);", "\xa9", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, @"&#(\d+);", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "xp_cmdshell", "", RegexOptions.IgnoreCase);
            //删除与数据库相关的词
            htmlstring = Regex.Replace(htmlstring, "select", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "insert", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "delete from", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "count''", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "drop table", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "truncate", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "asc", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "mid", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "char", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "xp_cmdshell", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "exec master", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "net localgroup administrators", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "and", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "net user", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "or", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "net", "", RegexOptions.IgnoreCase);
            //Htmlstring = Regex.Replace(Htmlstring, "*", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "-", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "delete", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "drop", "", RegexOptions.IgnoreCase);
            htmlstring = Regex.Replace(htmlstring, "script", "", RegexOptions.IgnoreCase);
            //特殊的字符
            htmlstring = htmlstring.Replace("<", "");
            htmlstring = htmlstring.Replace(">", "");
            htmlstring = htmlstring.Replace("*", "");
            htmlstring = htmlstring.Replace("-", "");
            htmlstring = htmlstring.Replace("?", "");
            htmlstring = htmlstring.Replace("'", "''");
            htmlstring = htmlstring.Replace(",", "");
            htmlstring = htmlstring.Replace("/", "");
            htmlstring = htmlstring.Replace(";", "");
            htmlstring = htmlstring.Replace("*/", "");
            htmlstring = htmlstring.Replace("\r\n", "");
            htmlstring = HttpContext.Current.Server.HtmlEncode(htmlstring).Trim();
            return htmlstring;
        }
        /// <summary>
        /// DES加密
        /// </summary>
        /// <param name="pToEncrypt">加密字符串</param>
        /// <param name="sKey">密钥</param>
        /// <returns></returns>
        public static string string_Encrypt(string pToEncrypt, string sKey)
        {
            if (pToEncrypt == "") return "";
            if (sKey.Length < 8) sKey = sKey + "xuE29xWp";
            if (sKey.Length > 8) sKey = sKey.Substring(0, 8);
            DESCryptoServiceProvider des = new DESCryptoServiceProvider();
            //把字符串放到byte数组中  
            //原来使用的UTF8编码，我改成Unicode编码了，不行  
            byte[] inputByteArray = Encoding.Default.GetBytes(pToEncrypt);
            //建立加密对象的密钥和偏移量  
            //原文使用ASCIIEncoding.ASCII方法的GetBytes方法  
            //使得输入密码必须输入英文文本  
            des.Key = Encoding.Default.GetBytes(sKey);
            des.IV = Encoding.Default.GetBytes(sKey);
            MemoryStream ms = new MemoryStream();
            CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(), CryptoStreamMode.Write);
            //Write  the  byte  array  into  the  crypto  stream  
            //(It  will  end  up  in  the  memory  stream)  
            cs.Write(inputByteArray, 0, inputByteArray.Length);
            cs.FlushFinalBlock();
            //Get  the  data  back  from  the  memory  stream,  and  into  a  string  
            StringBuilder ret = new StringBuilder();
            foreach (byte b in ms.ToArray())
                //Format  as  hex  
                ret.AppendFormat("{0:X2}", b);
            return ret.ToString();
        }
        /// <summary>
        /// DES解密
        /// </summary>
        /// <param name="pToDecrypt">解密字符串</param>
        /// <param name="sKey">解密密钥</param>
        /// <returns></returns> 
        public static string string_Decrypt(string pToDecrypt, string sKey)
        {
            if (pToDecrypt == "") return "";
            if (sKey.Length < 8) sKey = sKey + "xuE29xWp";
            if (sKey.Length > 8) sKey = sKey.Substring(0, 8);
            try
            {
                DESCryptoServiceProvider des = new DESCryptoServiceProvider();
                //Put  the  input  string  into  the  byte  array  
                byte[] inputByteArray = new byte[pToDecrypt.Length / 2];
                for (int x = 0; x < pToDecrypt.Length / 2; x++)
                {
                    int i = (Convert.ToInt32(pToDecrypt.Substring(x * 2, 2), 16));
                    inputByteArray[x] = (byte)i;
                }
                //建立加密对象的密钥和偏移量，此值重要，不能修改  
                des.Key = Encoding.Default.GetBytes(sKey);
                des.IV = Encoding.Default.GetBytes(sKey);
                MemoryStream ms = new MemoryStream();
                CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(), CryptoStreamMode.Write);
                //Flush  the  data  through  the  crypto  stream  into  the  memory  stream  
                cs.Write(inputByteArray, 0, inputByteArray.Length);
                cs.FlushFinalBlock();
                //Get  the  decrypted  data  back  from  the  memory  stream  
                //建立StringBuild对象，CreateDecrypt使用的是流对象，必须把解密后的文本变成流对象  
                StringBuilder ret = new StringBuilder();
                return System.Text.Encoding.Default.GetString(ms.ToArray());
            }
            catch
            {
                return "";
            }
        }
    }
}