SQL Injection Prevention Example From MS Press

There is a MS Press book that I read which used the following code to prevent SQL Injection attempts from succeeding within a SProc. However, I have found that this example is too inclusive. For example, this will catch the value "Spanish Moss", when this clearly not an injection attempt. Why is that?

DECLARE @Query NVARCHAR(50);
SET @Query = N'Spanish Moss';
/* Also return true: */
--SET @Query = N'experienced vb.net coder';
--SET @Query = N'executive suite';

IF UPPER(@Query) LIKE UPPER(N'%0x%')
OR UPPER(@Query) LIKE UPPER(N'%;%')
OR UPPER(@Query) LIKE UPPER(N'%''%')
OR UPPER(@Query) LIKE UPPER(N'%--%')
OR UPPER(@Query) LIKE UPPER(N'%/*%*/%')
OR UPPER(@Query) LIKE UPPER(N'%EXEC%')
OR UPPER(@Query) LIKE UPPER(N'%xp_%')
OR UPPER(@Query) LIKE UPPER(N'%sp_%')
OR UPPER(@Query) LIKE UPPER(N'%SELECT%')
OR UPPER(@Query) LIKE UPPER(N'%INSERT%')
OR UPPER(@Query) LIKE UPPER(N'%UPDATE%')
OR UPPER(@Query) LIKE UPPER(N'%DELETE%')
OR UPPER(@Query) LIKE UPPER(N'%TRUNCATE%')
OR UPPER(@Query) LIKE UPPER(N'%CREATE%')
OR UPPER(@Query) LIKE UPPER(N'%ALTER%')
OR UPPER(@Query) LIKE UPPER(N'%DROP%')
BEGIN
RAISERROR(N'Possible SQL injection attempt.', 16, 1);
RETURN;
END
ELSE
BEGIN
PRINT N'All is well!';
RETURN;
END

If I remove "Spanish" from the query, or the check for "sp_" from the IF statement, this runs fine. So I know the line where this is caught, but it doesn't make sense to me. I can also duplicate this using the work "experienced" which gets caught by the "xp_" check.

Can someone offer some assistance?

- - - -
- Will -
- - - -
http://www.strohlsitedesign.com
http://blog.strohlsitedesign.com/
http://skins.strohlsitedesign.com/