/// 检查文件格式是否充许
/// </summary>
/// <param name="ImageFormat">待检查的文件格式</param>
/// <returns>是否合法</returns>
private bool HasThisForamt(string ImageFormat)
{
string ImageFormats = "gif|png|gif|bmp"
if (ImageFormats.ToLower().IndexOf(ImageFormat.ToLower())>=0)
{
return true
}
return false
}
/// <summary>
/// 判断上传的图片文件格式是否合法
/// </summary>
/// <param name="upControl">文件上传控件</param>
/// <returns>是否合法</returns>
private bool IsImageFormat( FileUpload upControl )
{
try
{
using (System.Drawing.Image img = System.Drawing.Image.FromStream(upControl.FileContent))
{
if (HasThisForamt("Bmp") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Bmp)) return true
if (HasThisForamt("Emf") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Emf)) return true
if (HasThisForamt("Exif") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Exif)) return true
if (HasThisForamt("Gif") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Gif)) return true
if (HasThisForamt("Icon") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Icon)) return true
if (HasThisForamt("Jpeg") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Jpeg)) return true
if (HasThisForamt("MemoryBmp") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.MemoryBmp)) return true
if (HasThisForamt("Png") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Png)) return true
if (HasThisForamt("Tiff") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Tiff)) return true
if (HasThisForamt("Wmf") &&img.RawFormat.Equals(System.Drawing.Imaging.ImageFormat.Wmf)) return true
}
}
catch
{
//此文件不是图像文件
}
//您所选择的文件格式不充许
return false
}
//...........
public bool IsEligibilityFileFormat(FileUpload fs)
{
bool xx = false
//System.IO.FileStream fs = new System.IO.FileStream(sFileName, System.IO.FileMode.Open, System.IO.FileAccess.Read)
System.IO.BinaryReader r = new System.IO.BinaryReader(fs.FileContent)
string bx = " "
byte buffer
try
{
buffer = r.ReadByte()
bx = buffer.ToString()
buffer = r.ReadByte()
bx += buffer.ToString()
}
catch (Exception exc)
{
}
r.Close()
//fs.Close()
Response.Write(bx)
if (bx == "7790 " || bx == "8297 " || bx == "8075 ") //7790:exe,8297:rar,8075:pk
{
xx = true
}
return xx
/*
7173 gif
255216 jpg
7790 exe dll
00 ani--ico--cur
7783
255254 --ini
9146 -- ini
5866
6395 hlp
8269 reg
70105 log
205168
7384 chm
5549 txt
117115 txt
5450 txt
5666 psd
255254 rdp
10056 bt种子
8297 rar
64101 bat
*/
}
可以防止，第一种就是用文件头的方式验证，代码如下：private bool IsAllowedExtension(HttpPostedFile hifile)
{
bool result = false
FileStream strFile = new FileStream(hifile.FileName, System.IO.FileMode.Open, System.IO.FileAccess.Read)
BinaryReader bReader = new BinaryReader(strFile)
string fileclass = ""
byte buffer
try
{
buffer = bReader.ReadByte()
fileclass = buffer.ToString()
buffer = bReader.ReadByte()
fileclass += buffer.ToString()
}
catch
{
return false
}
bReader.Close()
strFile.Close()
/*文件扩展名说明
*4946/104116 txt
*7173gif
*255216 jpg
*13780 png
*6677bmp
*239187 txt,aspx,asp,sql
*208207 xls.doc.ppt
*6063xml
*6033htm,html
*4742js
*8075xlsx,zip,pptx,mmap,zip
*8297rar
*01 accdb,mdb
*/
//纯图片
String[] fileType = {
"7173",//gif
"255216", //jpg
"13780"//png
}
for (int i = 0i <fileType.Lengthi++)
{
if (fileclass == fileType[i])
{
result = true
break
}
}
Response.Write(fileclass)
return result
}
protected void btnOk_Click(object sender, EventArgs e)
{
if (IsAllowedExtension(uFile.PostedFile))
{
Response.Write("<script>alert('OK')</script>")
}
}
第二种用文件流的方式验证
/// <summary>
/// 验证流
/// </summary>
/// <param name="UpFile">上传控件(HttpPostedFile 或 HtmlInputFile)</param>
/// <param name="_extensions">扩展名（数组）</param>
/// <param name="SavePath">保存路径（绝对路径）</param>
/// <param name="size">文件大小单位(KB)</param>
/// <param name="err">错误信息</param>
/// <param name="SourcePage">源页面</param>
/// <returns>返回新文件名</returns>
public static string UpLoadFileImg(HtmlInputFile UpFile, string[] _extensions, string SavePath, int size,
out string err, System.Web.UI.Page SourcePage)
{
//锁定页面
SourcePage.Application.Lock()
string error = String.Empty//错误信息
string Img = UpFile.PostedFile.FileName.Trim()//获取文件名
string Exten = Path.GetExtension(UpFile.PostedFile.FileName).ToLower()//获取文件的扩展名
bool IsExtension = false//是否存在该扩展名
string FileType = UpFile.PostedFile.ContentType.ToLower()//获取文件的类型
if (Img != "")
{
//判断图片扩展名和类型验证
for (int i = 0i <_extensions.Lengthi++)
{
if (Exten == _extensions[i].ToString())
{
IsExtension = true
break
}
}
if (!IsExtension &&(FileType != "image/gif" || FileType != "image/x-png" || FileType != "image/pjpeg"
|| FileType != "image/bmp"))
{
error = "对不起,您不能上传该类型的文件!"
err = error
return Img
}
if (UpFile.PostedFile.ContentLength >(size * 1024))
{
error = "对不起,文件大小不能大于" + size + "KB!"
err = error
return Img
}
try
{
Img = DateTime.Now.Ticks + Exten//重新给文件命名
//上传文件
UpFile.PostedFile.SaveAs(SavePath + Img)
//最后一步高级验证，图片上传后的操作，判断是否存在危险
StreamReader sr = new StreamReader(SavePath + Img, Encoding.Default)
string strContent = sr.ReadToEnd()
sr.Close()
string str = "request|.getfolder|.createfolder|.deletefolder|.createdirectory|.deletedirectory|.saveas"
str+="|wscript.shell|script.encode|server.|.createobject|execute|activexobject|language="
foreach (string s in str.Split('|'))
{
if (strContent.IndexOf(s) != -1)
{
File.Delete(SavePath + Img)
error = "对不起,该文件内容存在风险,禁止上传!"
err = error
return Img
}
}
}
catch
{
error = "系统错误,上传失败!"
}
}
else
error = "对不起,请选择要上传的文件!"
//取消锁定页面
SourcePage.Application.UnLock()
err = error
return Img
}
您好，这个是授权码USKD48YPPEL7G4V5 F18PHEU9XWR8ZUWP
或者
H67HEYAKDY9E2R21 Y20HAEPJSQ78C3QD
或者
W0JZ6Z5XPNQ3G51E 1N8J5Q99EJ5T75G9
祝您生活愉快！
