我的网站上有 HealthMonitoring。我的 90% 的页面都是以这种格式访问的

http://www.itsmywebsite.com/showproduct.aspx?id=somenumber

我正在检查 WebEvents_events 表，发现我的表主要包含两个错误

ERROR 1

0002609ad8vdf45f8daffc7de8716e32    2013-11-25 17:01:18.153 2013-11-25 11:01:18.153 System.Web.Management.WebViewStateFailureAuditEvent 9877    1455    4009    50204   Viewstate verification failed. Reason: Viewstate was invalid.   C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\  /   C15472-132183   http://www.itsmywebsite.com/showproduct.aspx    NULL    Event code: 4009
    Event message: Viewstate verification failed. Reason: Viewstate was invalid.
    Event time: 11/25/2013 11:01:18 AM
    Event time (UTC): 11/25/2013 5:01:18 PM
    Event ID: 0002609ad8vdf45f8daffc7de8716e32
    Event sequence: 9877
    Event occurrence: 1455
    Event detail code: 50204

    Application information:
        Application domain: /LM/W3SVC/94/ROOT-1-1302342423433586
        Trust level: Full
        Application Virtual Path: /
        Application Path: C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\
        Machine name: C15472-132183

    Process information:
        Process ID: 28796
        Process name: w3wp.exe
        Account name: C15472-132183\itsmywebsitecom_web

    Request information:
        Request URL: http://www.itsmywebsite.com/showproduct.aspx
        Request path: /showproduct.aspx
        User host address: 186.xx.xxx.xx
        User: 
        Is authenticated: False
        Authentication Type: 
        Thread account name: C15472-132183\itsmywebsitecom_web

    ViewStateException information:
        Exception message: Invalid viewstate. 
        Client IP: 186.xx.xxx.xx
        Port: 29991
        Referer: 
        Path: /showproduct.aspx
        User-Agent: Mozilla/4.0 (compatible; Synapse)

ERROR 2

0034c75464ecdd32dee41996bfe 2013-11-24 13:19:52.360 2013-11-24 07:19:52.360 System.Web.Management.WebRequestErrorEvent  8727    1313    3005    0   An unhandled exception has occurred.    C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\  /   C15472-132183   http://www.itsmywebsite.com/showproduct.aspx?id=-1%27   System.FormatException  Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 11/24/2013 7:19:52 AM
Event time (UTC): 11/24/2013 1:19:52 PM
Event ID: 0034c75464ecdd32dee41996bfe
Event sequence: 8727
Event occurrence: 1313
Event detail code: 0

Application information:
    Application domain: /LM/W3SVC/94/ROOT-1-1302342423433586
    Trust level: Full
    Application Virtual Path: /
    Application Path: C:\HostingSpaces\parthak\itsmywebsite.com\wwwroot\
    Machine name: C15472-132183

Process information:
    Process ID: 14932
    Process name: w3wp.exe
    Account name: C15472-132183\itsmywebsitecom_web

Exception information:
    Exception type: System.FormatException
    Exception message: Input string was not in a correct format.

Request information:
    Request URL: http://www.itsmywebsite.com/showproduct.aspx?id=-1%27
    Request path: /showproduct.aspx
    User host address: 178.xxx.xxx.xxx
    User: 
    Is authenticated: False
    Authentication Type: 
    Thread account name: C15472-132183\itsmywebsitecom_web

Thread information:
    Thread ID: 31
    Thread account name: C15472-132183\itsmywebsitecom_web
    Is impersonating: False
    Stack trace:    at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
   at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
   at System.String.System.IConvertible.ToInt32(IFormatProvider provider)
   at System.Convert.ChangeType(Object value, TypeCode typeCode, IFormatProvider provider)
   at System.Web.UI.WebControls.Parameter.GetValue(Object value, String defaultValue, TypeCode type, Boolean convertEmptyStringToNull, Boolean ignoreNullableTypeChanges)
   at System.Web.UI.WebControls.Parameter.GetValue(Object value, Boolean ignoreNullableTypeChanges)
   at System.Web.UI.WebControls.Parameter.get_ParameterValue()
   at System.Web.UI.WebControls.ParameterCollection.GetValues(HttpContext context, Control control)
   at System.Web.UI.WebControls.ObjectDataSourceView.ExecuteSelect(DataSourceSelectArguments arguments)
   at System.Web.UI.WebControls.BaseDataList.GetData()
   at System.Web.UI.WebControls.DataList.CreateControlHierarchy(Boolean useDataSource)
   at System.Web.UI.WebControls.BaseDataList.OnDataBinding(EventArgs e)
   at System.Web.UI.WebControls.BaseDataList.DataBind()
   at System.Web.UI.WebControls.BaseDataList.EnsureDataBound()
   at System.Web.UI.WebControls.BaseDataList.CreateChildControls()
   at System.Web.UI.Control.EnsureChildControls()
   at System.Web.UI.WebControls.BaseDataList.get_Controls()
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.Helpers.SetInputControlsHighlight(Control container, String className, Boolean onlyTextBoxes)
   at MB.TheBeerHouse.UI.BasePage.OnLoad(EventArgs e)
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

请指导我如何防止这些错误的发生。

Update:

最糟糕的部分是附加到 url 的 -1%27。现在我再次检查，它被用在以下网址中

http://www.itsmywebsite.com/showproduct.aspx?id=-1%27 [invalid]
http://www.itsmywebsite.com/browseproduct.aspx?id=-1%27 [invalid]

等等。这些 url 都不存在，我的健康监控正在记录所有这些错误。我的表中现在有大约 100K。

有效的网址是http://www.itsmywebsite.com/showproduct.aspx?id=127

如果没有办法阻止它们，我可以通过重定向或任何其他最佳实践在代码中处理它们，这样它就不会生成错误并填满我的表

您已成为 SQL 注入攻击的目标，攻击者可能是机器人，也可能是某个在商店中寻找信用卡的随机黑客。网上商店不断受到攻击，您将遭受更多您可以想象的攻击。

为了防止此类攻击，您可以安装 Web 应用程序防火墙，例如 mod_security（适用于 IIS 和 Apache）。该插件将检查提供的请求，对其进行分析并在将其传递给您的应用程序之前阻止每个攻击意图。

Web 应用程序防火墙只是又一项缓解措施，真正的解决方案是拥有安全的代码。在这种特殊情况下，您可以实现堆叠查询、限制权限、验证输入（在这种情况下，您的应用程序应该首先捕获错误，并在未接收到整数参数时正确处理它）并正确处理错误（例如显示自定义页面和不是可能暴露内部信息的默认错误）。仅举几个例子。

如果您需要了解任何特别的信息，请告诉我。