SQL注入过滤

        Global.asax.cs
        /// <summary>
        /// 当有数据时交时，触发事件
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        protected void Application_BeginRequest(Object sender, EventArgs e)
        {
            //遍历Post参数，隐藏域除外
            foreach(string i in this.Request.Form)
            {
                if(i=="__VIEWSTATE")continue;
                this.goErr(this.Request.Form[i].ToString());   
            }
            //遍历Get参数。
            foreach(string i in this.Request.QueryString)
            {
                if(SqlFilter(this.Request.QueryString[i].ToString()));
                                   this.Response.Redirect("~/error.htm?mid=-110");

            }
           
        }

        /// <summary>
        ///SQL注入过滤
        /// </summary>
        /// <param name="InText">要过滤的字符串</param>
        /// <returns>如果参数存在不安全字符，则返回true</returns>
        public  bool SqlFilter(string InText)
        {
            string word="and|exec|insert|select|delete|update|chr|mid|master|or|truncate|char|declare|join";
            if(InText==null)
                return false;
            foreach(string i in word.Split('|'))
            {
                if((InText.ToLower().IndexOf(i+" ")>-1)||(InText.ToLower().IndexOf(" "+i)>-1))
                {
                    return true;
                }
            }
            return false;
        }