防SQL注入方式.net

/// <summary>
/// 过滤字符串
/// </summary>
/// <param name="str">待处理的字符串</param>
/// <returns></returns>
public static string StrFind(string str)
{
str = System.Web.HttpContext.Current.Server.HtmlEncode(str);
string questringstr = "*|and|exec|insert|select|delete|update|count|master|truncate|declare|char(|mid(|chr(|'";
string[] strarry = questringstr.Split('|');
for (int i = 0; i < strarry.Length; i++)
{
if (str.IndexOf(strarry[i] + " ") > 0)
{
System.Web.HttpContext.Current.Response.Write("<script language='javascript'>alert('非法操作！您的操作已经被记录,同时将收集一部分您的计算机资料。');</script>");
}
}
str = str.Replace("'", "''");
return str;
}