Asp.net anti-SQL Injection parameter Filtering

// <Summary>
// Trigger an event when data is handed in
/// </Summary>
// <Param name = "sender"> </param>
// <Param name = "e"> </param>
Protected void Application_BeginRequest (Object sender, EventArgs e)
{
// Traverse the Post parameter, except for hidden fields
Foreach (string I in this. Request. Form)
{
If (I = "_ VIEWSTATE") continue;
This. goErr (this. Request. Form [I]. ToString ());
}
// Traverse Get parameters.
Foreach (string I in this. Request. QueryString)
{
This. goErr (this. Request. QueryString [I]. ToString ());

}
}

/// <Summary>
/// SQL Injection Filtering
/// </Summary>
/// <Param name = "InText"> string to be filtered </param>
/// <Returns> If the parameter contains insecure characters, true is returned. </returns>
Public bool SqlFilter (string InText)
{
String word = "and | exec | insert | select | delete | update | chr | mid | master | or | truncate | char | declare | join | cmd ";
If (InText = null)
Return false;
Foreach (string I in word. Split ('| '))
{
If (InText. toLower (). indexOf (I + "")>-1) | (InText. toLower (). indexOf ("" + I)>-1 ))
{
Return true;
}
}
Return false;
}

/// <Summary>
/// Check whether the parameter contains SQL characters
/// </Summary>
/// <Param name = "tm"> </param>
Private void goErr (string tm)
{
If (SqlFilter (tm ))
{
Response. Write ("<script> window. alert ('the data you entered has an incorrect parameter! '); "+" </"+" Script> ");
}
}