Request参数批量过滤，防注入（逐步完善中...）

    /// <summary>
    /// 检查请求参数是否安全
    /// </summary>
    /// <returns>有注入危险的请求参数</returns>
    public string CheckRequstSafe()
    {
        string sErrPara = "";

        foreach (string sRequestKey in Request.QueryString)
        {
            if (!IsSafeToSql(Request.QueryString[sRequestKey]))
            {
                sErrPara = (sErrPara == "" ? sRequestKey : (sErrPara + "，" + sRequestKey));
            }
        }

        foreach (string sRequestKey in Request.Form)
        {
            if (!IsSafeToSql(Request.Form[sRequestKey]))
            {
                sErrPara = sErrPara == "" ? sRequestKey : (sErrPara + "，" + sRequestKey);
            }
        }

        return sErrPara;
    }

    /// <summary>
    /// 检查是否含有“sql注入”常用字符
    /// </summary>
    /// <param name="_sParaValues">待检查字符串</param>
    /// <returns>true-安全 false-有注入危险</returns>
    public bool IsSafeToSql(string _sRequest)
    {
        bool bIsSafe = true;

        string strTemp = "insert|select|delete|update|drop|create|";
        strTemp += "declare|dbcc|exec|xp_|set|;|‘|--|@";

        string[] arrStr = strTemp.Split(‘|‘);

        _sRequest = _sRequest.ToLower();
        

        foreach (string sItem in arrStr)
        {
            if (_sRequest.IndexOf(sItem) != -1)
            {
                bIsSafe = false;
            }
        }

        return bIsSafe;
    }