ASP.NET地址栏form提交安全验证

using System;
using System.Collections.Generic;
using System.Text;
using System.Web;
using System.Text.RegularExpressions;
using System.IO;


namespace SecModule
{
    public class CheckUrlParameter : IHttpModule
    {

        #region IHttpModule 成员

        public void Dispose()
        {

        }

        public void Init(HttpApplication context)
        {
            context.BeginRequest += new EventHandler(context_BeginRequest);
        }
        void context_BeginRequest(object sender, EventArgs e)
        {
            HttpApplication application = (HttpApplication)sender;
            HttpContext context = application.Context;
            // 做些实际的工作，HttpContext对象都获得了，剩下的基本可以自由发挥了

            //检测URL安全信息
            if (!context.Request.RawUrl.Contains("WebResource") && !context.Request.RawUrl.Contains("ScriptResource") && context.Request.QueryString.Count > 0)
            {
                for (int i = 0; i < context.Request.QueryString.Count; i++)
                {
                    if (CheckUrl(context.Request.QueryString[i]))
                    {
                        context.Response.Redirect("~/UserControl/ErrorPage.html?err=6");
                        context.Response.End();
                    }
                }
            }

            //检测上传文件的安全信息
            string ext = "";
            for (int i = 0; i < context.Request.Files.Count; i++)
            {
                ext = Path.GetExtension(context.Request.Files[i].FileName).ToLower();
                if (ext == ".aspx" || ext == ".asp" || ext == ".php" || ext == ".jsp")
                {
                    context.Response.Write("<script type=‘text/javascript‘>alert(‘禁止上传非法文件！‘);location.href=location.href;</script>");
                    context.Response.End();
                }
            }

            //检测Form表单值的安全信息
            string parmeter = "";
            for (int i = 0; i < context.Request.Form.Count; i++)
            {

                parmeter = context.Request.Form[i];
                if (context.Request.Form.AllKeys[i] == "__VIEWSTATE") continue;
                if (CheckForm(parmeter))
                {
                    if (context.Request.RawUrl.ToLower().Contains("ajax"))
                    {
                        context.Response.Write("输入内容有非法字符！");
                    }
                    else
                    {
                        context.Response.Write("<script type=‘text/javascript‘>alert(‘输入内容有非法字符！‘);location.href=location.href;</script>");
                    }
                    context.Response.End();
                }
            }
        }
        /// <summary>
        /// 检测URL参数
        /// </summary>
        /// <param name="parameter">传入参数值</param>
        /// <returns>有危险返回True，无返回False</returns>
        public bool CheckUrl(string parameter)
        {
            Regex reg = new Regex("--|\"|\‘|=|db_name|<script>|[*]|sysobjects|sysdatabases|syscolumns|select|from|drop|delete|insert|update|exec", RegexOptions.IgnoreCase);
            return reg.IsMatch(parameter);
        }

        /// <summary>
        /// 检测Form表单
        /// </summary>
        /// <param name="FormValue">传入表单值</param>
        /// <returns></returns>
        public bool CheckForm(string FormValue)
        {
            Regex reg = new Regex("--|db_name|<script>|drop|insert", RegexOptions.IgnoreCase);
            return reg.IsMatch(FormValue);
        }

        #endregion
    }
}