using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Web;
using CY.Config;

namespace CY_ValidaterHttpModule
{
    /// <summary>
    /// 过滤非法输入，如：防止SQL注入，其他非法输入
    /// </summary>
    public class ValidaterHttpModule : IHttpModule 
    {
        public void Dispose()
        {

        } 
        public void Init(HttpApplication context)
        {
            context.AcquireRequestState += new EventHandler(context_AcquireRequestState);
        }

        private void context_AcquireRequestState(object sender, EventArgs e)
        {
            HttpContext context = ((HttpApplication)sender).Context;
            //context.Response.Write('1');
            //context.Response.End();
            //return;

            try
            {
                string getkeys = string.Empty;
                string sqlErrorPage = "~/RemindError.html";//转向的错误提示页面 
                string keyvalue = string.Empty;

                string requestUrl = context.Request.Path.ToString();
                //url提交数据
                if (context.Request.QueryString != null)
                {
                    for (int i = 0; i < context.Request.QueryString.Count; i++)
                    {
                        getkeys = context.Request.QueryString.Keys[i];
                        keyvalue = context.Server.UrlDecode(context.Request.QueryString[getkeys]);

                        if (!FilterSql(keyvalue))
                        {
                            context.Response.Redirect(sqlErrorPage);
                            context.Response.End();
                            break;
                        }
                    }
                }
                //表单提交数据
                if (context.Request.Form != null)
                {
                    for (int i = 0; i < context.Request.Form.Count; i++)
                    {
                        getkeys = context.Request.Form.Keys[i];
                        keyvalue = context.Server.HtmlDecode(context.Request.Form[i]);
                        if (getkeys == "__VIEWSTATE") continue;
                        if (getkeys == "__EVENTVALIDATION") continue; 
                        if (!FilterSql(keyvalue))
                        {
                            context.Response.Redirect(sqlErrorPage);
                            context.Response.End();
                            break;
                        }
                    }
                }
            }
            catch (Exception ex)
            {
            }
        }

        /// <summary> 
        /// 过滤非法关键字，这个可以按照项目灵活配置 
        /// </summary> 
        /// <param name="key"></param> 
        /// <returns></returns> 
        private bool FilterSql(string key)
        {
            bool flag = true;
            try
            {
                if (!string.IsNullOrEmpty(key))
                {
                    //非法字段配置
                    string sqlStr = WebInfo.Instance.IllegalInput;
                    string[] sqlStrArr = sqlStr.Split('|');
                    foreach (string strChild in sqlStrArr)
                    {
                        if (key.Trim().ToLower().IndexOf(strChild.Trim().ToLower()) != -1)
                        {
                            flag = false;
                            break;
                        }
                    }
                }
            }
            catch
            {
                flag = false;
            }
            return flag;
        }

    }

}