SQL防注入漏洞的方法

 #region SQL防注入漏洞的方法
    /// <summary>
    /// SQL防注入漏洞的方法
    /// </summary>
    /// <param name="strVar"></param>
    /// <returns>是否存在特定字符</returns>
    public static bool IsExistSpecialCharacter(string strVar)
    {
        string str_In = "'|;|and|exec|insert|select|delete|update|count|*|%|char|mid|master|truncate|char|declare|--";
        string[] sList = str_In.Split('|');
        foreach (string s in sList)
        {
            if (strVar.ToLower().Contains(s))
            {
                return true;
            }
        }
        return false;
    }

    public static string ClearSpecialCharacter(string strVar)
    {
        string str_In = "'|;|and|exec|insert|select|delete|update|count|*|%|char|mid|master|truncate|char|declare|--";
        string[] sList = str_In.Split('|');
        foreach (string s in sList)
        {
            strVar = strVar.Replace(s, "");
        }
        return strVar;
    }
    #endregion