Can this code make sql injection impossible? : I found this code in DNN PortalSecurity.cs. This is supposed to make input string sql injection safe. Do you see any issues here ?

     private string FormatRemoveSQL(string strSQL)
            {
                const string BadStatementExpression = ";|--|create|drop|select|insert|delete|update|union|sp_|xp_|exec|/\\*.*\\*/|declare|waitfor|%|&";
                return Regex.Replace(strSQL, BadStatementExpression, " ", RegexOptions.IgnoreCase | RegexOptions.Compiled).Replace("'", "''");
            }