using System;

using System.Data;

using System.Configuration;

using System.Web;

using System.Web.Security;

using System.Web.UI;

using System.Web.UI.WebControls;

using System.Web.UI.WebControls.WebParts;

using System.Web.UI.HtmlControls;

using System.Data.SqlClient;

/// <summary>

/// SqlCheck ?????

/// </summary>



// #region ,#endregion ??VS????????,??????                      

public class SqlCheck

{

	public SqlCheck()

	{ 

    }



    

    public SqlConnection oconn()

    {

        SqlConnection conn = new SqlConnection();

        conn.ConnectionString = ConfigurationManager.ConnectionStrings["StudyConnectionString"].ToString();

        //?1??????   JK1986_CheckSql();

        JK1986_CheckSql();

        if ( conn.State == ConnectionState.Closed  ) 

        {

            conn.Open();

        }

        return conn;

    }





    public DataTable  getsource(string getds) 

    {

        SqlConnection conn = oconn();

        SqlDataAdapter da = new SqlDataAdapter(getds, conn);

        DataSet ds = new DataSet();

        da.Fill(ds,"news" );

        return ds.Tables["news"];

    }

    



    public static  void JK1986_CheckSql()

    {

        string jk1986_sql = "exec?select?drop?alter?exists?union?and?or?xor?order?mid?asc?execute?xp_cmdshell?insert?update?delete?join?declare?char?sp_oacreate?wscript.shell?xp_regwrite?'?;?--";

        string[] jk_sql = jk1986_sql.Split('?');

        foreach (string jk in jk_sql)

        {

            // -----------------------? Post ??-----------------------

            if ( System.Web.HttpContext.Current.Request.Form != null)

            {

                for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)

                {

                    string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k];

                    string getip;

                    if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true)

                    {

                       System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('?????????');</" + "script>");

                       System.Web.HttpContext.Current.Response.Write("????????????? ?" + "<br>");

                       if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)

                        {

                            getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];

                        }

                        else

                        {

                            getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];

                        }

                        System.Web.HttpContext.Current.Response.Write("? ? I  P ?" + getip + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + DateTime.Now.ToString() + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??P O S T " + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + jk + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + "<br>");

                        System.Web.HttpContext.Current.Response.End();

                    }

                }

            }

            // -----------------------? GET ??-----------------------

            if (System.Web.HttpContext.Current.Request.QueryString != null)

            {

                for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)

                {

                    string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k];

                    string getip;

                    if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true)

                    {

                        System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('?????????');</" + "script>");

                        System.Web.HttpContext.Current.Response.Write("????????????? ?" + "<br>");

                        if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)

                        {

                            getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];

                        }

                        else

                        {

                            getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];

                        }

                        System.Web.HttpContext.Current.Response.Write("? ? I  P ?" + getip + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + DateTime.Now.ToString() + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??G E T " + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + jk + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + "<br>");

                        System.Web.HttpContext.Current.Response.End();

                    }

                }

            }



            // -----------------------? Cookies ??-----------------------

            if (System.Web.HttpContext.Current.Request.Cookies != null)

            {

                for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)

                {

                    string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k];

                    string getip;

                    if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true)

                    {

                        System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('?????????');</" + "script>");

                        System.Web.HttpContext.Current.Response.Write("????????????? ?" + "<br>");

                        if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)

                        {

                            getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];

                        }

                        else

                        {

                            getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];

                        }

                        System.Web.HttpContext.Current.Response.Write("? ? I  P ?" + getip + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + DateTime.Now.ToString() + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ?? Cookies " + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + jk + "<br>");

                        System.Web.HttpContext.Current.Response.Write("? ? ? ??" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + "<br>");

                        System.Web.HttpContext.Current.Response.End();

                    }

                }

            }



        }

    }     

    

}