对输入框的特殊字串进行过滤，防止SQL注入

以前不用这种方法过滤字符串，在网上看到这种方法，好像还行，收藏一下。不过别人如果要显示像"&#59;"  的字符的时候也要替换一下

 

/// <summary>
  /// 对输入框的特殊字串进行过滤，防止SQL注入
  /// </summary>
  /// <param name="strFromText">要被过滤的字符串</param>
  /// <returns>过滤后的字符串</returns>
  public static string SqlInsertEncode(string strFromText)
  {
  if (!System.String.IsNullOrEmpty(strFromText) && strFromText != "")
  {
  strFromText = strFromText.Replace(";", "&#59;");
  strFromText = strFromText.Replace("!", "&#33;");
  strFromText = strFromText.Replace("@", "&#64;");
  strFromText = strFromText.Replace("$", "&#36;");
  strFromText = strFromText.Replace("*", "&#42;");
  strFromText = strFromText.Replace("(", "&#40;");
  strFromText = strFromText.Replace(")", "&#41;");
  strFromText = strFromText.Replace("-", "&#45;");
  strFromText = strFromText.Replace("+", "&#43;");
  strFromText = strFromText.Replace("=", "&#61;");
  strFromText = strFromText.Replace("|", "&#124;");
  strFromText = strFromText.Replace("//", "&#92;");
  strFromText = strFromText.Replace("/", "&#47;");
  strFromText = strFromText.Replace(":", "&#58;");
  strFromText = strFromText.Replace("/"", "&#34;");
  strFromText = strFromText.Replace("'", "&#39;");
  strFromText = strFromText.Replace("<", "&#60;");
  strFromText = strFromText.Replace(" ", "&#32;");
  strFromText = strFromText.Replace(">", "&#62;");
  strFromText = strFromText.Replace(" ", "&#32;");
  }
  return strFromText;
  }