根据EntityFramework写的重写sql语句的类

代码如下

class ReSql {
        #region 防sql注入重写sql语句//出自http://www.cnblogs.com/ahjesus 尊重作者辛苦劳动成果,转载请注明出处,谢谢!
        public string RewriteSql(string sql) {
            sql = Regex.Replace(sql, @"\s+", " ");
            string[] sqlArr = sql.Replace("where", "拆").Split('拆');
            string newsql = "";
            for (int i = 0; i < sqlArr.Length; i++) {
                if (i > 0) {
                    string item = "where" + sqlArr[i];
                    sqlArr[i] = item;
                }//出自http://www.cnblogs.com/ahjesus 尊重作者辛苦劳动成果,转载请注明出处,谢谢! 
                if (i < sqlArr.Length - 1) {
                    newsql += sqlArr[i];
                }
            }
            if (!string.IsNullOrWhiteSpace(newsql)) {
                sql = newsql.Replace("'", "''");
            }

            string where = "";
            if (sqlArr.Length > 1) {
                where = sqlArr[sqlArr.Length - 1];

                //过滤and
                where = RegexReplacewithEvaluator(where);

                string regexStr = @"(?<==)\s*[^\w*\.]\w*[^\)]|(?<=like)\s*\W*\w*\W*\s*";//出自http://www.cnblogs.com/ahjesus 尊重作者辛苦劳动成果,转载请注明出处,谢谢! 
                //原来的，不够优化//(?<==)\s*\w*[^\.|^\)]\s*|(?<==)\s*\W\w*\W\s*|(?<==)\s*\w*\s*|(?<=like)\s*\W*\w*\W*\s*
                MatchEvaluator evaluator = new MatchEvaluator(ReplaceMatchEvaluator);
                where = Regex.Replace(where, regexStr, evaluator).Replace("'", "''");


                sql = "exec sp_executesql N'" + sql + where + "'";

                string paramsType = "";
                string paramsKey = "";
                string paramsValue = "";
                foreach (KeyValuePair<string, string> item in strDic) {
                    paramsType = ",N'";
                    paramsKey += "@" + item.Key + " nvarchar(max),";

                    paramsValue += ",@" + item.Key + "=" + item.Value;
                }
                if (!string.IsNullOrWhiteSpace(paramsKey)) {
                    sql += paramsType + paramsKey.Substring(0, paramsKey.Length - 1) + "'";
                    sql += paramsValue;
                }
                //出自http://www.cnblogs.com/ahjesus 尊重作者辛苦劳动成果,转载请注明出处,谢谢! 
                sql = Regex.Replace(sql, "过滤项", 过滤项);
            }
            return sql;
        }
        Dictionary<string, string> strDic = new Dictionary<string, string>();
        private string ReplaceMatchEvaluator(Match m) {
            string guid = Guid.NewGuid().ToString("N");
            strDic.Add(guid, m.Value);
            return " @" + guid + " ";
            //出自http://www.cnblogs.com/ahjesus 尊重作者辛苦劳动成果,转载请注明出处,谢谢! 
        }

        private string RegexReplacewithEvaluator(string where) {
            string regexStr = @"and\s{1}\(.*\)";
            MatchEvaluator evaluator = new MatchEvaluator(Replace过滤项);
            return Regex.Replace(where, regexStr, evaluator);
        }
        private string 过滤项 = "";
        private string Replace过滤项(Match m) {
            过滤项 = m.Value.Replace("'", "''");
            return "过滤项";
            //出自http://www.cnblogs.com/ahjesus 尊重作者辛苦劳动成果,转载请注明出处,谢谢! 
        }

        #endregion
    }

 使用方法

ReSql resql = new ReSql();
sql = resql.RewriteSql(tsql);

//出自http://www.cnblogs.com/ahjesus
尊重作者辛苦劳动成果,转载请注明出处,谢谢!