|
|
|
@ -19,7 +19,7 @@ namespace DSWeb.SoftMng.Common
|
|
|
|
|
/// <returns>如果参数存在不安全字符,则返回true</returns>
|
|
|
|
|
public static bool SqlFilterExist(string source)
|
|
|
|
|
{
|
|
|
|
|
string pattern = @"(insert|(?<!is)delete(?!(?<=isdelete))|database|\Bgo\B|db_name|sys.|exec|create|grant|revoke|alter|execute|drop|openrowset|drop table|update|truncate|asc\(|mid\(|char\(|xp_cmdshell|netlocalgroup administrators|net user|dec|exec|database|chr|declare)([\s+.*]|$)";
|
|
|
|
|
string pattern = @"(insert|(?<!is)delete(?!(?<=isdelete))|database|(?<=[\p{L}\p{N}_])\bgo\b(?=[\p{L}\p{N}_])|(?<!\s)\bgo\b(?!\s)(?:(?!\r?\n).)*|(?<=\r?\n)\bgo\b(?:(?!\r?\n).)*(?=\r?\n)|\bgo\b(?=(?:(?!\r?\n).)*\s*$)|db_name|sys.|exec|create|grant|revoke|alter|execute|drop|openrowset|drop table|update|truncate|asc\(|mid\(|char\(|xp_cmdshell|netlocalgroup administrators|net user|dec|exec|database|chr|declare)([\s+.*]|$)";
|
|
|
|
|
if (Regex.IsMatch(source, pattern, RegexOptions.IgnoreCase))
|
|
|
|
|
return true;
|
|
|
|
|
return false;
|
|
|
|
|