Determine if there is a SQL attack code in the string

Determine if there is a SQL attack code in an input box

 Public Const stringSQLSTR2 =@"exec|cast|convert|set|insert|select|delete|update|alter|drop|count|chr|varchar|nvarchar|nchar|char[]*\ ([]* |asc[]*\ ([]*|mid[]*\ ([]*|substring|master|truncate|declare|xp_cmdshell|restore|backup|net[]+user|net[]+ localgroup[]+administrators"; /// <summary>        ///determine if there is a SQL attack code in the string/// </summary>        /// <param name= "inputstring" >incoming user submission data</param>        /// <returns>true-security; false-with injection attack possible;</returns>         Public Static BOOLPROCESSSQLSTR (stringinputstring) {            //if (string. IsNullOrEmpty (inputstring))//return false;            stringSqlstr =aqiooinfo.sqlstr2; Try            {                if((InputString! =NULL) && (inputstring! =String.Empty)) {stringStr_regex =@"Wen | hu |\b ("+ Sqlstr +@") \b"; Regex regex=NewRegex (Str_regex, regexoptions.ignorecase); //string s = Regex.match (inputstring). Value;                     if(Regex.IsMatch (inputstring))//|| Regex.IsMatch (InputString, @ "[-|;|,|\/|\ (|\) |\[|\]|\}|\{|%| @|\*|!| \ '] ")                        return false; }            }            Catch            {                return false; }            return true; }

View Code