asp.net - 哪些 ASP.NET 命令会导致代码不安全？

Question

就我个人而言，我尝试编写安全的 ASP.NET 代码。然而，我对自己编写的代码变得非常偏执，因为我曾经为注册商工作(欺诈目标很高)。是否有任何我应该仔细研究的 ASP.NET 函数(除了 SQL 访问 - 我知道不要执行动态 SQL)。

Answer 1

这是一篇优秀的 MSDN 文章:Security Practices: ASP.NET 2.0 Security Practices at a Glance .

摘录:

How to prevent cross site scripting

Validate input and encode output. Constrain input by validating it for type, length, format, and range. Use the HttpUtility.HtmlEncode method to encode output if it contains input from the user, such as input from form fields, query strings, and cookies or from other sources, such as databases. Never just echo input back to the user without validating and/or encoding the data. The following example shows how to encode a form field.

Response.Write(HttpUtility.HtmlEncode(Request.Form["name"]));

If you return URL strings that contain input to the client, use the HttpUtility.UrlEncode method to encode these URL strings, as shown here.

Response.Write(HttpUtility.UrlEncode(urlString));

If you have pages that need to accept a range of HTML elements, such as through some kind of rich text input field, you must disable ASP.NET request validation for the page.

Turn On Custom Errors To Keep Errors Private

<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />