sql注入过滤

    /// <summary>
    /// Sql过滤器
    /// </summary>
    public class SqlCleaner
    {
        private static List<string> injectWords = new List<string>();

        /// <summary>
        /// 静态构造函数
        /// </summary>
        static SqlCleaner()
        {
            #region 关键字（可任意变更，不区分大小写）
            injectWords.Add(@"add");
            injectWords.Add(@"procedure");
            injectWords.Add(@"alter");
            injectWords.Add(@"and");
            injectWords.Add(@"from");
            injectWords.Add(@"grant");
            injectWords.Add(@"right");
            injectWords.Add(@"having");
            injectWords.Add(@"in");
            injectWords.Add(@"select");
            injectWords.Add(@"inner");
            injectWords.Add(@"insert");
            injectWords.Add(@"into");
            injectWords.Add(@"join");
            injectWords.Add(@"left");
            injectWords.Add(@"create");
            injectWords.Add(@"like");
            injectWords.Add(@"table");
            injectWords.Add(@"not");
            injectWords.Add(@"database");
            injectWords.Add(@"truncate");
            injectWords.Add(@"delete");
            injectWords.Add(@"union");
            injectWords.Add(@"update");
            injectWords.Add(@"drop");
            injectWords.Add(@"or");
            injectWords.Add(@"where");
            injectWords.Add(@"exec");
            injectWords.Add(@"execute");
            injectWords.Add(@"exists");
            #endregion

            #region 符号（可任意变更，不区分大小写）
            injectWords.Add(@"--");
            injectWords.Add(@"+");
            injectWords.Add(@"-");
            injectWords.Add(@"*");
            injectWords.Add(@"=");
            #endregion
        }

        /// <summary>
        /// 过滤
        /// </summary>
        /// <param name="input">输入</param>
        /// <returns>输出</returns>
        public static string Clean(string input)
        {
            if (string.IsNullOrWhiteSpace(input))
            {
                return input;
            }
            injectWords.ForEach(injectWord =>
            {
                var startIndex = input.IndexOf(injectWord, StringComparison.CurrentCultureIgnoreCase);

                while (startIndex >= 0)
                {
                    input = input.Remove(startIndex, injectWord.Length);

                    startIndex = input.IndexOf(injectWord, StringComparison.CurrentCultureIgnoreCase);
                }
            });
            return input;
        }
    }