Functions of Asp.net for SQL Injection prevention and HTML tag removal

// <Summary>
/// Filter tags
/// </Summary>
/// <Param name = "nohtml"> source code that includes HTML, script, database keyword, and special characters </param>
/// <Returns> the marked text has been removed </returns>
Public static string nohtml (string htmlstring)
{
If (htmlstring = NULL)
{
Return "";
}
Else
{
// Delete the script
Htmlstring = RegEx. Replace (htmlstring, @ "<SCRIPT [^>] *?>. *? </SCRIPT> "," ", regexoptions. ignorecase );
// Delete HTML
Htmlstring = RegEx. Replace (htmlstring, @ "<(. [^>] *)>", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "([\ r \ n]) [\ s] +", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "-->", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "<! --. * "," ", Regexoptions. ignorecase );

Htmlstring = RegEx. Replace (htmlstring, @ "& (quot | #34);", "\" ", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (Amp | #38);", "&", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (LT | #60);", "<", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (GT | #62);", ">", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (nbsp | #160);", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (iexcl | #161);", "\ xA1", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (cent | #162);", "\ xa2", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (pound | #163);", "\ xa3", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& (copy | #169);", "\ xa9", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, @ "& # (\ D +);", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "xp_mongoshell", "", regexoptions. ignorecase );

// Delete database-Related Words
Htmlstring = RegEx. Replace (htmlstring, "select", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "insert", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "delete from", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "Count'' "," ", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "Drop table", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "truncate", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "ASC", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "mid", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "char", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "xp_mongoshell", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "Exec master", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "net localgroup Administrators", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "and", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "Net user", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "or", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "Net", "", regexoptions. ignorecase );
// Htmlstring = RegEx. Replace (htmlstring, "*", "", regexoptions. ignorecase );
// Htmlstring = RegEx. Replace (htmlstring, "-", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "delete", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "Drop", "", regexoptions. ignorecase );
Htmlstring = RegEx. Replace (htmlstring, "script", "", regexoptions. ignorecase );

// Special characters
Htmlstring = htmlstring. Replace ("<","");
Htmlstring = htmlstring. Replace ("> ","");
Htmlstring = htmlstring. Replace ("*","");
Htmlstring = htmlstring. Replace ("-","");
Htmlstring = htmlstring. Replace ("? ","");
Htmlstring = htmlstring. Replace (",","");
Htmlstring = htmlstring. Replace ("/","");
Htmlstring = htmlstring. Replace (";","");
Htmlstring = htmlstring. Replace ("*/","");
Htmlstring = htmlstring. Replace ("\ r \ n ","");
Htmlstring = httpcontext. Current. server. htmlencode (htmlstring). Trim ();

Return htmlstring;
}

}