冠霖的部落格

step1.

aspx頁加入

<script language='javascript' type="text/javascript" src='injectiondetect.js'></script>
</head>

step2.

加入js檔 ,內容如下

function validateInjection()
{
          var i = 0;
          for(i = 0; i < document.forms[0].elements.length;i++)
          {
            if(document.forms[0].elements[i].type == 'text' &&
               document.forms[0].elements[i].getAttribute("ci") != null)
            {
              var elem = document.forms[0].elements[i];
              if(elem.value != null &&
                 (elem.value.indexOf('\'') != -1 ||
                  elem.value.indexOf('--') != -1 ||
                  elem.value.indexOf(' OR ') != -1))
              {   
                alert('possible injection detected.') 
                return false;
              } 
            }
          }
          return true;
}

============================================

如果有偵測到就會跳出訊息

possible injection detected