62,046
社区成员
发帖
与我相关
我的任务
分享
/// <summary>
/// 文件编号
/// </summary>
public enum FileExtension
{
JPG = 255216,
GIF = 7173,
BMP = 6677,
PNG = 13780,
//RAR = 8297
// 255216 jpg;
// 7173 gif;
// 6677 bmp,
// 13780 png;
// 7790 exe dll,
// 8297 rar
// 6063 xml
// 6033 html
// 239187 aspx
// 117115 cs
// 119105 js
// 210187 txt
//255254 sql
}
public static class FileValidation
{
/// <summary>
/// 是否允许
/// </summary>
/// <param name="oFile"></param>
/// <param name="fileEx"></param>
/// <returns></returns>
public static bool IsAllowedExtension(HttpPostedFile oFile, FileExtension[] fileEx)
{
int fileLen = oFile.ContentLength;
byte[] imgArray = new byte[fileLen];
oFile.InputStream.Read(imgArray, 0, fileLen);
MemoryStream ms = new MemoryStream(imgArray);
System.IO.BinaryReader br = new System.IO.BinaryReader(ms);
string fileclass = "";
byte buffer;
try
{
buffer = br.ReadByte();
fileclass = buffer.ToString();
buffer = br.ReadByte();
fileclass += buffer.ToString();
}
catch { }
br.Close();
ms.Close();
foreach (FileExtension fe in fileEx)
{
if (Int32.Parse(fileclass) == (int)fe)
return true;
}
return false;
}
/// <summary>
/// 上传前的图片是否可靠
/// </summary>
/// <param name="oFile"></param>
/// <returns></returns>
public static bool IsSecureUploadPhoto(HttpPostedFile oFile)
{
bool isPhoto = false;
string fileExtension = System.IO.Path.GetExtension(oFile.FileName).ToLower();
string[] allowedExtensions = { ".gif", ".png", ".jpeg", ".jpg", ".bmp" };
for (int i = 0; i < allowedExtensions.Length; i++)
{
if (fileExtension == allowedExtensions[i])
{
isPhoto = true;
break;
}
}
if (!isPhoto) return true;//不是图片,既然允许上传,那就不检测了
FileExtension[] fe = {FileExtension.BMP,
FileExtension.GIF,
FileExtension.JPG,
FileExtension.PNG
};
if (IsAllowedExtension(oFile, fe))
return true;
else
return false;
}
/// <summary>
/// 上传后的图片是否安全
/// </summary>
/// <param name="photoFile">物理地址</param>
/// <returns></returns>
public static bool IsSecureUpfilePhoto(string photoFile)
{
bool isPhoto = false;
string Img = "Yes";
string fileExtension = System.IO.Path.GetExtension(photoFile).ToLower();
string[] allowedExtensions = { ".gif", ".png", ".jpeg", ".jpg", ".bmp" };
for (int i = 0; i < allowedExtensions.Length; i++)
{
if (fileExtension == allowedExtensions[i])
{
isPhoto = true;
break;
}
}
if (!isPhoto) return true;//不是图片,既然允许上传,那就不检测了
StreamReader sr = new StreamReader(photoFile, System.Text.Encoding.Default);
string strContent = sr.ReadToEnd();
sr.Close();
string str = "request|<script|.getfolder|.createfolder|.deletefolder|.createdirectory|.deletedirectory|.saveas|wscript.shell|script.encode|server.|.createobject|execute|activexobject|language=";
foreach (string s in str.Split('|'))
if (strContent.ToLower().IndexOf(s) != -1)
{
File.Delete(photoFile);
Img = "No";
break;
}
return (Img == "Yes");
}
}
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="_Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
<title>无标题页</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:FileUpload ID="FileUpload1" runat="server" />
<asp:Button ID="btn_upload" runat="server" OnClick="btn_upload_Click" Text="上传" />
</div>
</form>
</body>
</html>
后台文件:
第一种方法:安全性相对第二种低,把文本文件1.txt改成1.jpg照样可以上传,但其实现方法容易理解,实现也简单,所以网上很多还是采取这种方法.
using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void btn_upload_Click(object sender, EventArgs e)
{
Boolean fileOk = false;
string path = Server.MapPath("~/images/");
//判断是否已经选取文件
if (FileUpload1.HasFile)
{
//取得文件的扩展名,并转换成小写
string fileExtension = System.IO.Path.GetExtension (FileUpload1.FileName).ToLower();
//限定只能上传jpg和gif图片
string[] allowExtension = { ".jpg", ".gif" };
//对上传的文件的类型进行一个个匹对
for (int i = 0; i < allowExtension.Length; i++)
{
if (fileExtension == allowExtension[i])
{
fileOk = true;
break;
}
}
}
else
{
Response.Write("<script>alert(’你还没有选择文件’);</script>");
}
//如果扩展名符合条件,则上传
if (fileOk)
{
FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);
Response.Write("<script>alert(’上传成功’);</script>");
}
else
{
}
}
}
第二种方法,可以实现真正意义上的文件类型判断,推荐使用这种方法.
using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
public partial class _Default : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void btn_upload_Click(object sender, EventArgs e)
{
try
{
//判断是否已经选取文件
if (FileUpload1.HasFile)
{
if (IsAllowedExtension(FileUpload1))
{
string path = Server.MapPath("~/images/");
FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);
Response.Write("<script>alert(’上传成功’);</script>");
}
else
{
Response.Write("<script>alert(’您只能上传jpg或者gif图片’);</script>");
}
}
else
{
Response.Write("<script>alert(’你还没有选择文件’);</script>");
}
}
catch (Exception error)
{
Response.Write(error.ToString());
}
}
//真正判断文件类型的关键函数
public static bool IsAllowedExtension(FileUpload hifile)
{
System.IO.FileStream fs = new System.IO.FileStream(hifile.PostedFile.FileName, System.IO.FileMode.Open, System.IO.FileAccess.Read);
System.IO.BinaryReader r = new System.IO.BinaryReader(fs);
string fileclass = "";
byte buffer;
try
{
buffer = r.ReadByte();
fileclass = buffer.ToString();
buffer = r.ReadByte();
fileclass += buffer.ToString();
}
catch
{
}
r.Close();
fs.Close();
if (fileclass == "255216" || fileclass == "7173")//说明255216是jpg;7173是gif;6677是BMP,13780是PNG;7790是exe,8297是rar
{
return true;
}
else
{
return false;
}
}
}