SQL数据库注入防范 ASP.NET Globle警告

在项目中的Global.asax页面代码中加下面的代码，就可以有效的防范简单的SQL注入。

protected void Application_BeginRequest(Object sender, EventArgs e)
  {
         string Sql_1 = "exec |insert+ |select+ |delete |update |count |chr |mid |master+|truncate |char |declare |drop+ |drop+table |creat+ |creat+table |'+ |>=+|<+|>+|==+|-|'|;";
   string Sql_2 = "exec+ |insert+ |delete+ |update+ |count( |count+ |chr+ |+mid( |+mid+ |+master+ |truncate+ |char+ |+char( |declare+ |drop+ |creat+ |drop+table |creat+table";
   string[] sql_c = Sql_1.Split('|');
   string[] sql_c1 = Sql_2.Split('|');
   if (Request.QueryString != null)
   {
    foreach (string sl in sql_c)
    {
     if (Request.QueryString.ToString().ToLower().IndexOf(sl.Trim()) >= )
     {
      Response.Write("警告！你的IP已经被记录!");//
      Response.Write(sl);
      Response.Write(Request.QueryString.ToString());
      Response.End();
      break;
     }
    }
   }
   if (Request.Form.Count > )
   {
    string s1 = Request.ServerVariables["SERVER_NAME"].Trim();//服务器名称
    if (Request.ServerVariables["HTTP_REFERER"] != null)
    {
     string s2 = Request.ServerVariables["HTTP_REFERER"].Trim();//http接收的名称
     string s3 = "";
     if (s1.Length > (s2.Length - ))
     {
      s3 = s2.Substring();
     }
     else
     {
      s3 = s2.Substring(, s1.Length);
     }
     if (s3 != s1)
     {
      Response.Write("你的IP已被记录！警告！");//
      Response.End();
     }
    }
   }
  }