1 var Sstr = ["and","or","exec","execute","insert","select","delete","update","alter","create",
"drop","count","chr","char","asc","mid","substring","master","truncate","declare","xp_cmdshell","restore","backup",
"net +user","onblur","convert","onmouseover","ping","response","sysdatabases","net","localgroup",
"administrators","@","#","&","%","/","{","\""]; 2 var inputStr = ""; 3 if ($.trim($(‘#textareanote‘).val()) != "") { 4 inputStr = $(‘#textareanote‘).val(); 5 for (var x = 0; x < Sstr.length; x++) { 6 if (inputStr.match(Sstr[x])) { 7 alert("\""+Sstr[x]+"\"字符不符合输入规则,请检查输入内容!") 8 return false 9 } 10 } 11 12 }
输入的字符串是在前台调用ajax进行处理的,所以要在js中判断是否有攻击字符串。
一开始Sstr是定义的字符串,后来发现字符串不知道用什么符号隔开,就改成了数组,用for循环。
注意:括号不能加在这个数组里,会报错。对括号进行转义也没有用,后来想想,括号没什么影响,就没有过滤。
感谢我200多斤的同事鼎力相助,我是真不会写js。。