JDBC防止sql注入

1.过滤sql中某些字符

  public static string Filter(string value) 
        { 
            if (string.IsNullOrEmpty(value)) return string.Empty; 
            value = Regex.Replace(value, @";", string.Empty); 
            value = Regex.Replace(value, @"'", string.Empty); 
            value = Regex.Replace(value, @"&", string.Empty); 
            value = Regex.Replace(value, @"%20", string.Empty); 
            value = Regex.Replace(value, @"--", string.Empty); 
            value = Regex.Replace(value, @"==", string.Empty); 
            value = Regex.Replace(value, @" <", string.Empty); 
            value = Regex.Replace(value, @">", string.Empty); 
            value = Regex.Replace(value, @"%", string.Empty); 

            return value; 
        }
2.使用PrepareStatement