防SQL注入

//过滤特征字符
private const string StrKeyWord = @"select|insert|delete|from|count(|drop table|update|truncate|asc(|mid(|char(|xp_cmdshell|exec|master|net local group administrators|net user|or|and";
private const string StrRegex = @"-|;|,|/|(|)|[|]|{|}|%|@|*|'|!";

///<summary>
///检查字符串中是否包含Sql注入关键字
/// <param name="_key">被检查的字符串</param>
/// <returns>如果包含注入true;否则返回false</returns>
///</summary>
private bool CheckKeyWord(string _key)
{
string[] pattenString = StrKeyWord.Split('|');
string[] pattenRegex = StrRegex.Split('|');
foreach (string sqlParam in pattenString)
{
if (_key.Contains(sqlParam + " ") || _key.Contains(" " + sqlParam))
{
return true;
}
}
foreach (string sqlParam in pattenRegex)
{
if (_key.Contains(sqlParam))
{
return true;
}
}
return false;
}