public string CheckSql(string str) 
        { 
            string s=string.Empty ;
            if (str==null)
            { 
                s = string.Empty ;
            }
            else
            {
                s = str.Replace("'","").Replace("*","").Replace("select","")
                       .Replace("where","").Replace(";","").Replace("(","").Replace(")","").Replace("drop","").Replace("DROP","").Replace("and","").Replace("or","").Replace("delete","").Replace("asc","").Replace("<","").Replace(">","").Replace("=","").Replace(";","").Replace("&","").Replace("*","").Replace(" ","");
            } 
            return s;
        }

------解决方案--------------------
正则不行么？

------解决方案--------------------
	private bool ProcessSqlStr(string Str)  
		{  
			bool ReturnValue = true;  
			try  
			{  
				if (Str.Trim() != "")  
				{
				
					string SqlStr = "exec|insert+|select+|delete|update|count|chr|mid|master+|truncate|char|declare|drop+|drop+table|creat+|create|*|iframe|script|";
					SqlStr += "exec+|insert|delete+|update+|count(|count+|chr+|+mid(|+mid+|+master+|truncate+|char+|+char(|declare+|drop+table|creat+table";  
					string[] anySqlStr = SqlStr.Split('|');   
					foreach (string ss in anySqlStr)  
					{  
						if (Str.ToLower().IndexOf(ss) >= 0)  
						{  
							ReturnValue = false;  
							break;  
						}  
					}  
				}  
			}  
			catch  
			{  
				ReturnValue = false;  
			}  
			return ReturnValue;  
		}

------解决方案--------------------
 /// <summary>
       /// 检查是否含有非法字符
       /// </summary>
       /// <param name="str">要检查的字符串</param>
       /// <returns></returns>
       public static bool ChkBadChar(string str)
       {
           bool result = false;
           if (string.IsNullOrEmpty(str))
               return result;
           string strBadChar, tempChar;
           string[] arrBadChar;
           strBadChar = "@@,+,',--,%,^,&,?,(,),<,>,[,],{,},/,\\,;,:,\",\"\"";
           arrBadChar = SplitString(strBadChar, ",");
           tempChar = str;
           for (int i = 0; i < arrBadChar.Length; i++)
           {
               if (tempChar.IndexOf(arrBadChar[i]) >= 0)
                   result = true;