防SQL注入，关键字过滤解决办法

static public string SafeSql(this string str)        {            str = str.IsNullEmpty() ? "" : str.Replace("'", "''");            str = new Regex("exec", RegexOptions.IgnoreCase).Replace(str, "exec");            str = new Regex("xp_cmdshell", RegexOptions.IgnoreCase).Replace(str, "xp_cmdshell");            str = new Regex("select", RegexOptions.IgnoreCase).Replace(str, "select");            str = new Regex("insert", RegexOptions.IgnoreCase).Replace(str, "insert");            str = new Regex("update", RegexOptions.IgnoreCase).Replace(str, "update");            str = new Regex("delete", RegexOptions.IgnoreCase).Replace(str, "delete");            str = new Regex("drop", RegexOptions.IgnoreCase).Replace(str, "drop");            str = new Regex("create", RegexOptions.IgnoreCase).Replace(str, "create");            str = new Regex("rename", RegexOptions.IgnoreCase).Replace(str, "rename");            str = new Regex("truncate", RegexOptions.IgnoreCase).Replace(str, "truncate");            str = new Regex("alter", RegexOptions.IgnoreCase).Replace(str, "alter");            str = new Regex("exists", RegexOptions.IgnoreCase).Replace(str, "exists");            str = new Regex("master.", RegexOptions.IgnoreCase).Replace(str, "master.");            str = new Regex("restore", RegexOptions.IgnoreCase).Replace(str, "restore");            return str;        }