防SQL注入

/**//// <summary>
 2        /// 过滤SQL注入关键字[post,get]
 3       /// </summary>
 4       /// <param name="pStr"></param>
 5       /// <returns></returns>
 6       public static string  GetQueryStringSafe(string pStr)
 7       {
 8           bool IsValue = true;
 9           if (pStr != null && pStr.Length > 0)
10           {
11               pStr = pStr.ToLower();
12               string strSQLin = "'|and|--|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|&|%20|==|>|<";
13               string[] strSQLinGroup = strSQLin.Split(new char[] { '|' }, 23);//23个关键字,有待补充
14               for (int i = 0; i < strSQLinGroup.Length; i++)
15               {
16                   if (pStr.IndexOf(strSQLinGroup[i]) >= 0)//表示存在
17                   {
18                       IsValue = false;
19                       break;
20                   }
21               }
22           }
23           else
24           {
25               IsValue = false;
26           }
27           if (IsValue)
28           {
29               return pStr;
30           }
31           else
32               return "";
33       }