Question

在asp.net传递参数怎么过滤特殊字符？

在asp.net中，如news．aspx？id=xxx，怎么能在连接数据库的时候做一个整个网站传递参数的过滤，用来安全方面

Answer 1

1.传递前先加密 ，KEY是你自己定义的，加密解密函数KEY一致。
public static string Encode(string str, string key)
{
DESCryptoServiceProvider provider = new DESCryptoServiceProvider();
provider.Key = Encoding.ASCII.GetBytes(key.Substring(0, 8));
provider.IV = Encoding.ASCII.GetBytes(key.Substring(0, 8));
byte[] bytes = Encoding.GetEncoding("GB2312").GetBytes(str);
MemoryStream stream = new MemoryStream();
CryptoStream stream2 = new CryptoStream(stream, provider.CreateEncryptor(), CryptoStreamMode.Write);
stream2.Write(bytes, 0, bytes.Length);
stream2.FlushFinalBlock();
StringBuilder builder = new StringBuilder();
foreach (byte num in stream.ToArray())
{
builder.AppendFormat("{0:X2}", num);
}
stream.Close();
return builder.ToString();
}
2.获取参数后，解密
/// <summary>
/// Des 解密 GB2312
/// </summary>
/// <param name="str">Desc string</param>
/// <param name="key">Key ,必须为8位 </param>
/// <returns></returns>
public static string Decode(string str, string key)
{
try
{
DESCryptoServiceProvider provider = new DESCryptoServiceProvider();
provider.Key = Encoding.ASCII.GetBytes(key.Substring(0, 8));
provider.IV = Encoding.ASCII.GetBytes(key.Substring(0, 8));
byte[] buffer = new byte[str.Length / 2];
for (int i = 0; i < (str.Length / 2); i++)
{
int num2 = Convert.ToInt32(str.Substring(i * 2, 2), 0x10);
buffer[i] = (byte)num2;
}
MemoryStream stream = new MemoryStream();
CryptoStream stream2 = new CryptoStream(stream, provider.CreateDecryptor(), CryptoStreamMode.Write);
stream2.Write(buffer, 0, buffer.Length);
stream2.FlushFinalBlock();
stream.Close();
return Encoding.GetEncoding("GB2312").GetString(stream.ToArray());
}
catch (Exception)
{
return "";
}
}

Answer 2

你可以写一个过滤参数的函数，然后在显示页面即news.aspx页面调用这个函数来过滤id这个参数

Answer 3

传递参数的时候可以进行HttpUtility.UrlEncode和HttpUtility.UrlDecode