ASP. NET anti-injection two common functions; the string part is not very good

1. If all the parameters are numbers:
// Check whether all strings are numbers

Public static bool isnum (string Str)

{
Bool blresult = true;
If (STR = "")
Blresult = false;
Else
{
Foreach (char in Str)
{
If (! Char. isnumber (char ))
{
Blresult = false;
Break;
}
}
If (blresult)
If (Int. parse (STR) = 0)
Blresult = false;
}
Return blresult;

}

 

Application:
String topicid = request. querystring ["topicid"];

If (! Isnum (topicid ))
Server. Transfer ("error. aspx? Errid = 404 ");

2. If the parameter is text.

// Html Conversion

Public static string htmlstr (string CHR)

{
If (CHR = NULL)
Return "";
CHR = CHR. Replace ("<", "<");
CHR = CHR. Replace (">", "> ");
CHR = CHR. Replace ("/N", "<br> ");
CHR = CHR. Replace ("/"",""");
CHR = CHR. Replace ("'","'");
CHR = CHR. Replace ("","");
CHR = CHR. Replace ("/R ","");
Return (CHR );

}
Application: String strclass = htmlstr (request. querystring ["classname"]);