VS下SQL防注入

1. //在global.asax里添加如下代码段
3. protected void Application_BeginRequest(Object sender, EventArgs e) 
4.         { 
5.             //SQL防注入 
6.             string Sql_1 = "exec |insert+ |select+ |delete |update |count |chr |mid |master+ |truncate |char |declare |drop+ |drop+table |creat+ |creat+table"; 
7.             string Sql_2 = "exec+ |insert+ |delete+ |update+ |count( |count+ |chr+ |+mid( |+mid+ |+master+ |truncate+ |char+ |+char( |declare+ |drop+ |creat+ |drop+table |creat+table"; 
8.             string[] sql_c = Sql_1.Split(' |'); 
9.             string[] sql_c1 = Sql_2.Split(' |'); 
10. 　　 
11.             if(Request.QueryString != null) 
12.             { 
13.                 foreach (string sl in sql_c) 
14.                 { 
15.                     if(Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >=0) 
16.                     { 
17.                         Response.Write("警告！你的IP已经被记录!");//吓唬人的 
18.                         Response.Write(sl); 
19.                         Response.Write(Request.QueryString.ToString()); 
20.                         //System.Windows.Forms.MessageBox.Show("禁止提交外部数据","1",System.Windows.F 
21.                         //orms.MessageBoxButtons.OK,System.Windows.Forms.MessageBoxIcon.Error,System.Windows.Forms.MessageBoxDefaultButton.Button1,System.Windows.Forms.MessageBoxOptions.DefaultDesktopOnly); 
22.                         //Response.Redirect("http://www.163.com"); 
23.                         Response.End(); 
24.                         break; 
25.                     } 
26.                 } 
27.             } 
28.     
29.             if(Request.Form.Count > 0) 
30.             { 
31.      
32.                 string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称 
33.                 if(Request.ServerVariables["HTTP_REFERER"] != null) 
34.                 { 
35.                     string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称 
36.                     string s3 = ""; 
37.                     if(s1.Length > (s2.Length -7)) 
38.                     { 
39.                         s3 = s2.Substring(7); 
40.                     } 
41.                     else 
42.                     { 
43.                         s3 = s2.Substring(7,s1.Length); 
44.                     } 
45.                     if(s3 != s1) 
46.                     { 
47.                         Response.Write("你的IP已被记录！警告！");//吓人的 
48.                         //System.Windows.Forms.MessageBox.Show("禁止提交外部数据","1",System.Windows.Forms.MessageBoxButtons.OK,Sy 
49.                         //stem.Windows.Forms.MessageBoxIcon.Error,System.Windows.Forms.MessageBoxDefaultButton.Button1,System.Windows.Forms.MessageBoxOptions.DefaultDesktopOnly); 
50.                         //Response.Redirect("http://www.163.com"); 
51.                         Response.End(); 
52.                     } 
53.                 }  
54.             } 
55.         }