c# - 这段防止SQL注入(inject)的代码好不好？

Question

找到这段代码来防止使用 HTTPModules 进行一些基本的 MySql 注入(inject)

public class SampleSqlInjectionScreeningModuleCS : IHttpModule
{
    //Defines the set of characters that will be checked.
    //You can add to this list, or remove items from this list, as appropriate for your site
    public static string[] blackList = {"--",";--",";","/*","*/","@@","@",
                                       "char","nchar","varchar","nvarchar",
                                       "alter","begin","cast","create","cursor","declare","delete","drop","end","exec","execute",
                                       "fetch","insert","kill","open",
                                       "select", "sys","sysobjects","syscolumns",
                                       "table","update"};

    public void Dispose()
    {
        //no-op 
    }

    //Tells ASP.NET that there is code to run during BeginRequest
    public void Init(HttpApplication app)
    {
        app.BeginRequest += new EventHandler(app_BeginRequest);
    }

    //For each incoming request, check the query-string, form and cookie values for suspicious values.
    void app_BeginRequest(object sender, EventArgs e)
    {
        HttpRequest Request = (sender as HttpApplication).Context.Request;

        foreach (string key in Request.QueryString)
            CheckInput(Request.QueryString[key]);
        foreach (string key in Request.Form)
            CheckInput(Request.Form[key]);
        foreach (string key in Request.Cookies)
            CheckInput(Request.Cookies[key].Value);
    }

    //The utility method that performs the blacklist comparisons
    //You can change the error handling, and error redirect location to whatever makes sense for your site.
    private void CheckInput(string parameter)
    {
        for (int i = 0; i < blackList.Length; i++)
        {
            if ((parameter.IndexOf(blackList[i], StringComparison.OrdinalIgnoreCase) >= 0))
            {
                //
                //Handle the discovery of suspicious Sql characters here
                //
                HttpContext.Current.Response.Redirect("~/About.aspx");  //generic error page on your site
            }
        }
    }

}

这是一个好的代码还是你认为我需要在黑名单中添加更多的东西，或者忘记这个并尝试另一种方法来防止注入(inject)？

Answer 1

为什么在 parameterized queries 时执行字符串检查会为您(以及更多)工作吗？

对从代码发出的 SQL 语句使用 Parameters.Add() 或 Parameters.AddWithValue()。