记一次成功的sql注入入侵检测附带sql性能优化分享

代码如下:

CREATE TABLE [dbo].[my_sqllog](
[id] [bigint] IDENTITY(1,1) NOT NULL,
[hit] [bigint] NULL,
[sqltext] [varchar](max) COLLATE Chinese_PRC_CI_AS NULL,
[paramdetails] [varchar](max) COLLATE Chinese_PRC_CI_AS NULL,
[begintime] [datetime] NULL,
[endtime] [datetime] NULL,
[fromurl] [varchar](max) COLLATE Chinese_PRC_CI_AS NULL,
[ip] [varchar](20) COLLATE Chinese_PRC_CI_AS NULL,
[lastelapsedtime] [bigint] NULL,
CONSTRAINT [PK_my_sqllog] PRIMARY KEY CLUSTERED
(
[id] ASC
)WITH (IGNORE_DUP_KEY = OFF) ON [PRIMARY]
) ON [PRIMARY]

代码如下:

public static int ExecuteSqlLog(CommandType commandType, string commandText, params DbParameter[] cmdParams)
{
#region 参数处理
string colums = “”;
string dbtypes = “”;
string values = “”;
string paramdetails = “”;
if (cmdParams != null && cmdParams.Length > 0)
{
foreach (DbParameter param in cmdParams)
{
if (param == null)
{
continue;
}
colums += param.ParameterName + ” “;
dbtypes += param.DbType + ” “;
values += param.Value + “；”;
}
paramdetails = string.Format(” {0},{1},{2}”, colums, dbtypes, values);
}
string fromurl = “”;
if (System.Web.HttpContext.Current!=null)
{
fromurl = System.Web.HttpContext.Current.Request.Url.ToString();
}
// commandText = commandText.Replace(“‘”,”‘”).Replace(“;”,”；”);
SqlParameter[] parameters = new SqlParameter[]
{
new SqlParameter(“@hit”,1),
new SqlParameter(“@sqltext”,commandText),
new SqlParameter(“@paramdetails”,paramdetails),
new SqlParameter(“@begintime”,DateTime.Now),
new SqlParameter(“@endtime”,DateTime.Now),
new SqlParameter(“@fromurl”,fromurl),
new SqlParameter(“@ip”,Web.PressRequest.GetIP()),
new SqlParameter(“@lastelapsedtime”,0),
};
#endregion
using (DbConnection cOnnection= Factory.CreateConnection())
{
connection.COnnectionString= GetRealConnectionString(commandText);//ConnectionString;
string sql = “”;
// 执行DbCommand命令,并返回结果.
int id =
Utils.TypeConverter.ObjectToInt(ExecuteScalarLog(CommandType.Text,
“select top 1 id from my_sqllog where sqltext=@sqltext”,
new SqlParameter(“@sqltext”, commandText)));
if (id > 0)
{
sql = “update my_sqllog set hit=hit+1,ip=@ip,endtime=@endtime,fromurl=@fromurl where id=” + id;
}
else
{
sql = “insert into my_sqllog(hit,sqltext,paramdetails,begintime,endtime,fromurl,ip,lastelapsedtime) values(@hit,@sqltext,@paramdetails,@begintime,@endtime,@fromurl,@ip,@lastelapsedtime)”;
}
// 创建DbCommand命令,并进行预处理
DbCommand cmd = Factory.CreateCommand();
bool mustCloseCOnnection= false;
PrepareCommand(cmd, connection, (DbTransaction)null, commandType, sql, parameters, out mustCloseConnection);
// 执行DbCommand命令,并返回结果.
int retval = cmd.ExecuteNonQuery();
// 清除参数,以便再次使用.
cmd.Parameters.Clear();
if (mustCloseConnection)
connection.Close();
return retval;
}
}

代码如下:

private static object ExecuteScalarLog( CommandType commandType, string commandText, params DbParameter[] commandParameters)
{
if (COnnectionString== null || ConnectionString.Length == 0) throw new ArgumentNullException(“ConnectionString”);
// 创建并打开数据库连接对象,操作完成释放对象.
using (DbConnection cOnnection= Factory.CreateConnection())
{
if (cOnnection== null) throw new ArgumentNullException(“connection”);
//connection.Close();
connection.COnnectionString= GetRealConnectionString(commandText);
connection.Open();
// 创建DbCommand命令,并进行预处理
DbCommand cmd = Factory.CreateCommand();
bool mustCloseCOnnection= false;
PrepareCommand(cmd, connection, (DbTransaction)null, commandType, commandText, commandParameters, out mustCloseConnection);
// 执行DbCommand命令,并返回结果.
object retval = cmd.ExecuteScalar();
// 清除参数,以便再次使用.
cmd.Parameters.Clear();
if (mustCloseConnection)
connection.Close();
return retval;
}
}

代码如下:

//执行sql之前进行日志记录操纵
int log = ExecuteSqlLog(CommandType.Text, commandText, commandParameters);

代码如下:

public static object ExecuteScalar(DbConnection connection, CommandType commandType, string commandText, params DbParameter[] commandParameters)
{
if (cOnnection== null) throw new ArgumentNullException(“connection”);
//connection.Close();
connection.COnnectionString= GetRealConnectionString(commandText);
connection.Open();
// 创建DbCommand命令,并进行预处理
DbCommand cmd = Factory.CreateCommand();
bool mustCloseCOnnection= false;
PrepareCommand(cmd, connection, (DbTransaction)null, commandType, commandText, commandParameters, out mustCloseConnection);
//执行sql之前进行日志记录操纵
int log = ExecuteSqlLog(CommandType.Text, commandText, commandParameters);
// 执行DbCommand命令,并返回结果.
object retval = cmd.ExecuteScalar();
// 清除参数,以便再次使用.
cmd.Parameters.Clear();
if (mustCloseConnection)
connection.Close();
return retval;
}