在CSDN上看到的一个过滤方法，感觉还不错

        /// <summary>
        /// 把字符串中包含的敏感词替换成别的关键字
        /// </summary>
        /// <param name="s">原字符串</param>
        /// <param name="oldstr">要查找的敏感词</param>
        /// <param name="newstr">替换后的关键字</param>
        /// <returns>新的字符串</returns>
        private string ChangeSubStr(string s, string oldstr, string newstr)
        {
            if (s == null || s == "")
                return "";
            //转为小写
            string s1 = s.ToLower();
            //获取第一个匹配项的索引值
            int i = s1.IndexOf(oldstr);
            //如果有匹配的（有关键字）
            while (i != -)
            {
                //截取有敏感词之前的内容
                string l = s.Substring(, i);
                //截取敏感词之后的内容
                string r = s.Substring(i + oldstr.Length);
                //组合成新的内容
                s = l + newstr + r;
                s1 = s.ToLower();
                i = s1.IndexOf(oldstr);
            }
            return s;
        }

        private void CheckForSQLs(HttpRequest Request, HttpResponse Response)
        {
            string[] sql = new string[] { "/*", "*/", "--", "'", "declare", "select", "into", "insert", "update", "delete", "drop", "create", "exec", "master" };
            string[] sqlc = new string[] { "/ *", "* /", "- -", "＇", "ｄｅｃｌａｒｅ", "ｓｅｌｅｃｔ", "ｉｎｔｏ", "ｉｎｓｅｒｔ", "ｕｐｄａｔｅ", "ｄｅｌｅｔｅ", "ｄｒｏｐ", "ｃｒｅａｔｅ", "ｅｘｅｃ", "ｍａｓｔｅｒ" };

            //Form

            if (Request.Form.Count > )
            {
                Type type = typeof(System.Collections.Specialized.NameObjectCollectionBase);// Request.Form.GetType();
                PropertyInfo pi = type.GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);
                pi.SetValue(Request.Form, false, null);

                for (int i = ; i < Request.Form.Count; i++)
                {
                    string s = Request.Form[i];
                    //查询每个敏感词，如果字符里含有敏感词，则替换成中文类型的字符
                    for (int j = ; j < sql.Length; j++)
                        s = ChangeSubStr(s, sql[j], sqlc[j]);
                    Request.Form.Set(Request.Form.GetKey(i), s);
                }
                pi.SetValue(Request.Form, true, null);
            }

            //QueryString
            if (Request.QueryString.Count > )
            {
                Type type = typeof(System.Collections.Specialized.NameObjectCollectionBase);// Request.Form.GetType();
                PropertyInfo pi = type.GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);
                pi.SetValue(Request.QueryString, false, null);

                for (int i = ; i < Request.QueryString.Count; i++)
                {
                    string s = Request.QueryString[i];
                    for (int j = ; j < sql.Length; j++)
                        s = ChangeSubStr(s, sql[j], sqlc[j]);
                    Request.QueryString.Set(Request.QueryString.GetKey(i), s);
                }
                pi.SetValue(Request.QueryString, true, null);
            }

            //cookie
            for (int k = ; k < Request.Cookies.Count; k++)
            {
                HttpCookie c = Request.Cookies[k];

                if (c.Values.Count > )
                {
                    Type type = typeof(System.Collections.Specialized.NameObjectCollectionBase);// Request.Form.GetType();
                    PropertyInfo pi = type.GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);
                    pi.SetValue(c.Values, false, null);

                    for (int i = ; i < c.Values.Count; i++)
                    {
                        string s = c.Values[i];
                        for (int j = ; j < sql.Length; j++)
                            s = ChangeSubStr(s, sql[j], sqlc[j]);
                        c.Values.Set(c.Values.GetKey(i), s);
                    }
                    pi.SetValue(c.Values, true, null);
                }

                Response.Cookies.Set(c);
            }
        }