Simple regex question (C#, SQL Server)

Question

Hello, I have some Regex, it looks like this:

string regexForDrop = @"^((%27)|'|(\-\-))\s*(d|%64|%44)(r|%72|%52)(o|%6F|%4F)(p|%70|%50)$";

It works fine, when i write to the input "--drop", but it does not works, when i write "drop table users" or something like that. I need that it would be working, no matter what comes after "--drop". How i can implement that?

Thanks

Answer 1

It seems you trying to prevent a sql injection attack. For this use Parameterized Queries this way you don't need to check for injections.

Good Read:
http://weblogs.asp.net/scottgu/archive/2006/09/30/Tip_2F00_Trick_3A00_-Guard-Against-SQL-Injection-Attacks.aspx

Answer 2

string regexForDrop = @"^((%27)|'|(\-\-))\s*(d|%64|%44)(r|%72|%52)(o|%6F|%4F)(p|%70|%50).*$";

? or without the $

Answer 3

Remove the '$' at the end of your regular expression. $ matches the end of the input string.