asp.net of C anti sql injection component implementation code

In the server security column, I wrote an article titled "cracking the general Sql anti-injection method". I said that some general anti-injection methods do not filter the cookie data, which will leave an opportunity for hackers. Of course, my code also filters the submitted cookie data.
Code:

 
using System; 
using System.Configuration; 
using System.Web; 
using System.Globalization; 
namespace JNYW.StuM.SqlInject 
{ 
public class SqlstrAny : IHttpModule 
{ 
public void Init(HttpApplication application) 
{ 
application.BeginRequest += (new 
EventHandler(this.Application_BeginRequest)); 
} 
private void Application_BeginRequest(Object source, EventArgs e) 
{ 
ProcessRequest pr = new ProcessRequest(); 
pr.StartProcessRequest(); 
} 
public void Dispose() 
{ 
} 
} 
public class ProcessRequest 
{ 
private static string SqlStr = System.Configuration.ConfigurationManager.AppSettings["SqlInject"].ToString(); 
private static string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings["SQLInjectErrPage"].ToString(); 
/// 
///  Used to identify whether or not a stream is being transmitted  
/// 
/// 
/// 
bool IsUploadRequest(HttpRequest request) 
{ 
return StringStartsWithAnotherIgnoreCase(request.ContentType, "multipart/form-data"); 
} 
/// 
///  Comparison content type  
/// 
/// 
/// 
/// 
private static bool StringStartsWithAnotherIgnoreCase(string s1, string s2) 
{ 
return (string.Compare(s1, 0, s2, 0, s2.Length, true, CultureInfo.InvariantCulture) == 0); 
} 
//SQL Injection attack code analysis  
#region SQL Injection attack code analysis  
/// 
///  Process user submitted requests  
/// 
public void StartProcessRequest() 
{ 
HttpRequest Request = System.Web.HttpContext.Current.Request; 
HttpResponse Response = System.Web.HttpContext.Current.Response; 
try 
{ 
string getkeys = ""; 
if (IsUploadRequest(Request)) return; // Exit if it's a stream pass  
// String parameter  
if (Request.QueryString != null) 
{ 
for (int i = 0; i < Request.QueryString.Count; i++) 
{ 
getkeys = Request.QueryString.Keys[i]; 
if (!ProcessSqlStr(Request.QueryString[getkeys])) 
{ 
Response.Redirect(sqlErrorPage + "?errmsg=QueryString Contains an illegal string &sqlprocess=true"); 
Response.End(); 
} 
} 
} 
//form parameter  
if (Request.Form != null) 
{ 
for (int i = 0; i < Request.Form.Count; i++) 
{ 
getkeys = Request.Form.Keys[i]; 
if (!ProcessSqlStr(Request.Form[getkeys])) 
{ 
Response.Redirect(sqlErrorPage + "?errmsg=Form Contains an illegal string &sqlprocess=true"); 
Response.End(); 
} 
} 
} 
//cookie parameter  
if (Request.Cookies != null) 
{ 
for (int i = 0; i < Request.Cookies.Count; i++) 
{ 
getkeys = Request.Cookies.Keys[i]; 
if (!ProcessSqlStr(Request.Cookies[getkeys].Value)) 
{ 
Response.Redirect(sqlErrorPage + "?errmsg=Cookie Contains an illegal string &sqlprocess=true"); 
Response.End(); 
} 
} 
} 
} 
catch 
{ 
//  Error handling :  Process user submissions ! 
Response.Clear(); 
Response.Write("CustomErrorPage Configuration error "); 
Response.End(); 
} 
} 
/// 
///  Analyze whether the user request is normal  
/// 
///  Incoming user submission data  
///  Return whether or not SQL Injection attack code  
private bool ProcessSqlStr(string Str) 
{ 
bool ReturnValue = true; 
try 
{ 
if (Str != "") 
{ 
string[] anySqlStr = SqlStr.Split('|'); 
foreach (string ss in anySqlStr) 
{ 
if (Str.IndexOf(ss) >= 0) 
{ 
ReturnValue = false; 
break; 
} 
} 
} 
} 
catch 
{ 
ReturnValue = false; 
} 
return ReturnValue; 
} 
#endregion 
} 
} 

In practice, we add the top and bottom lines in the configuration section of the Web.config file
Here is the sample code:

 
<!-- Anti-injection setting --> 
<add value="and |exec |insert |select |delete |update |count | * |chr |mid |master |truncate |char |declare " key="SQLInject" /> 
<add value="ShowErr.aspx" key="SQLInjectErrPage" /> 

And in Web.Config file < SYSTEM.WEB > Plus the following code. Here is the sample code:

 
<!-- Anti-injection setting --> 
<HTTPMODULES> 
<aDD name="SqlstrAny" type="JNYW.StuM.SqlInject.SqlstrAny,SqlstrAny" /> 
</HTTPMODULES>