SQL SERVER 检查SQL条件参数中是否存在非法字符



CREATE function [dbo].[F_TOOL_ValidateSQL](@sql varchar(2048))
RETURNS INT
WITH EXECUTE AS CALLER
as
/*
检查SQL条件参数中是否存在非法字符,delete ,insert,update
*/
BEGIN
 declare @i int;
 set @sql=LOWER(@sql);
 set @i=charindex('delete',@sql)
  +charindex('update',@sql)
  +charindex('insert',@sql)
  +charindex('drop',@sql)
  +charindex('alter',@sql)
  +charindex('create',@sql)
  +charindex('sys',@sql)
  +charindex(';',@sql)
  +charindex('sp_',@sql);
 if(@i>0)
 begin
  return (1);
 end

 
 RETURN (0);
END
GO