ASP.net中防止sql注入攻击

    void Application_BeginRequest(object sender,EventArgs e)
    {
        StartRequest();
    }

    private bool ProcessSqlStr(string Str)
    {
        bool ReturnValue = true;
        if (Str != null)
        {
            try
            {
                if(Str.Trim()!= "")
                {
                    string SqlStr = "exec|insert|select|delete|master|update|truncate|declare|cmd|or|char|and|join|'|--";
                    string[] anySqlStr = SqlStr.Split('|');
                    foreach (string ss in anySqlStr)
                    {
                        if (!Str.ToLower().Contains("updatepanel"))
                        {
                            if (Str.ToLower().IndexOf(ss) >= 0)
                            {
                                ReturnValue = false;
                                break;
                            }
                        }
                    }
                }
            }
            catch
            {
                ReturnValue = false;
            }
        }
        return ReturnValue;
    }
   
    private void StartRequest()
    {
        try
        {
            string getkeys = "";
            string sqlErrorPage = "Error.aspx";
            if (System.Web.HttpContext.Current.Request.QueryString!= null)
            {
                for (int i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++)
                {
                    getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];
                    if (getkeys == "_VIEWSTATE") continue;
                    if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys].ToString()))
                    {
                        System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage);
                        System.Web.HttpContext.Current.Response.End();
                    }
                }
            }
            if (System.Web.HttpContext.Current.Request.Form != null)
            {
                for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)
                {
                    getkeys = System.Web.HttpContext.Current.Request.Form[2].ToString();
                    if (getkeys == "_VIEWSTATE") continue;
                    if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys].ToString()))
                    {
                        System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage);
                        System.Web.HttpContext.Current.Response.End();
                    }
                }
            }
        }
        catch
        {
            
        }
    }