diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerProvider.java b/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerProvider.java
index 82f4ff4649..d4bfbc3e37 100644
--- a/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerProvider.java
+++ b/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerProvider.java
@@ -38,6 +38,6 @@ public class SQLServerProvider extends WallProvider {
     public WallVisitor createWallVisitor() {
         return new SQLServerWallVisitor(config);
     }
-
+    
 
 }
diff --git a/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java
index a56a275aa4..b9eecc23f8 100644
--- a/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java
+++ b/src/main/java/com/alibaba/druid/filter/wall/spi/SQLServerWallVisitor.java
@@ -2,11 +2,28 @@ package com.alibaba.druid.filter.wall.spi;
 
 import java.util.ArrayList;
 import java.util.List;
+
+import com.alibaba.druid.filter.wall.IllegalSQLObjectViolation;
 import com.alibaba.druid.filter.wall.Violation;
 import com.alibaba.druid.filter.wall.WallConfig;
 import com.alibaba.druid.filter.wall.WallVisitor;
 import com.alibaba.druid.sql.SQLUtils;
+import com.alibaba.druid.sql.ast.SQLName;
 import com.alibaba.druid.sql.ast.SQLObject;
+import com.alibaba.druid.sql.ast.SQLStatement;
+import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
+import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
+import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
+import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
+import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
+import com.alibaba.druid.sql.ast.statement.SQLExprTableSource;
+import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
+import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
+import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
+import com.alibaba.druid.sql.ast.statement.SQLSelectStatement;
+import com.alibaba.druid.sql.ast.statement.SQLTruncateStatement;
+import com.alibaba.druid.sql.ast.statement.SQLUnionQuery;
+import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
 import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitor;
 import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitorAdapter;
 
@@ -23,25 +40,16 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
         this.config = config;
     }
 
-    /* (non-Javadoc)
-     * @see com.alibaba.druid.filter.wall.WallVisitor#getConfig()
-     */
     @Override
     public WallConfig getConfig() {
         return this.config;
     }
 
-    /* (non-Javadoc)
-     * @see com.alibaba.druid.filter.wall.WallVisitor#getViolations()
-     */
     @Override
     public List<Violation> getViolations() {
         return violations;
     }
 
-    /* (non-Javadoc)
-     * @see com.alibaba.druid.filter.wall.WallVisitor#isPermitTable(java.lang.String)
-     */
     @Override
     public boolean isPermitTable(String name) {
         if(!config.isTableCheck()){
@@ -52,12 +60,122 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
         return config.getPermitTables().contains(name);
     }
 
-    /* (non-Javadoc)
-     * @see com.alibaba.druid.filter.wall.WallVisitor#toSQL(com.alibaba.druid.sql.ast.SQLObject)
-     */
     @Override
     public String toSQL(SQLObject obj) {
         return SQLUtils.toMySqlString(obj);
     }
+    
 
+    public boolean visit(SQLIdentifierExpr x) {
+        String name = x.getName();
+        name = WallVisitorUtils.form(name);
+        if (config.isVariantCheck() && config.getPermitVariants().contains(name)) {
+            getViolations().add(new IllegalSQLObjectViolation(toSQL(x)));
+        }
+        return true;
+    }
+
+    public boolean visit(SQLPropertyExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
+
+    // executeQuery
+    public boolean visit(SQLBinaryOpExpr x) {
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLMethodInvokeExpr x) {
+        WallVisitorUtils.checkFunction(this, x);
+
+        return true;
+    }
+
+    public boolean visit(SQLExprTableSource x) {
+        WallVisitorUtils.check(this, x);
+
+        if (x.getExpr() instanceof SQLName) {
+            return false;
+        }
+
+        return true;
+    }
+
+    public boolean visit(SQLSelectGroupByClause x) {
+        WallVisitorUtils.checkHaving(this, x.getHaving());
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLSelectQueryBlock x) {
+        WallVisitorUtils.checkSelelct(this, x);
+
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLUnionQuery x) {
+        WallVisitorUtils.checkUnion(this, x);
+
+        return true;
+    }
+
+    public void preVisit(SQLObject x) {
+        if (!(x instanceof SQLStatement)) {
+            return;
+        }
+
+        if (config.isNoneBaseStatementAllow()) {
+            return;
+        }
+
+        if (x instanceof SQLInsertStatement) {
+
+        } else if (x instanceof SQLSelectStatement) {
+
+        } else if (x instanceof SQLDeleteStatement) {
+
+        } else if (x instanceof SQLUpdateStatement) {
+        } else if (x instanceof SQLTruncateStatement) {
+            if (!config.isTruncateAllow()) {
+                violations.add(new IllegalSQLObjectViolation(toSQL(x)));    
+            }
+        } else {
+            violations.add(new IllegalSQLObjectViolation(toSQL(x)));
+        }
+    }
+
+    @Override
+    public boolean visit(SQLSelectStatement x) {
+        if (!config.isSelelctAllow()) {
+            this.getViolations().add(new IllegalSQLObjectViolation(this.toSQL(x)));
+            return false;
+        }
+
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLInsertStatement x) {
+        if (!config.isInsertAllow()) {
+            this.getViolations().add(new IllegalSQLObjectViolation(this.toSQL(x)));
+            return false;
+        }
+
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLDeleteStatement x) {
+        WallVisitorUtils.checkDelete(this, x);
+        return true;
+    }
+
+    @Override
+    public boolean visit(SQLUpdateStatement x) {
+        WallVisitorUtils.checkUpdate(this, x);
+
+        return true;
+    }
 }
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java
index 56aa4838e7..41ecd14eea 100644
--- a/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MySqlWallPermitTableTest.java
@@ -1,28 +1,28 @@
-package com.alibaba.druid.bvt.filter.wall;
-
-import org.junit.Assert;
-
-import com.alibaba.druid.filter.wall.WallConfig;
-import com.alibaba.druid.filter.wall.WallUtils;
-
-import junit.framework.TestCase;
-
-/**
- * 这个场景测试访问MySql系统函数
- * 
- * @author admin
- */
-public class MySqlWallPermitTableTest extends TestCase {
-
-    public void test_default() throws Exception {
-        Assert.assertFalse(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) )"));
-    }
-    
-    public void test_allow() throws Exception {
-        WallConfig config = new WallConfig();
-        config.setTableCheck(false);
-        
-        Assert.assertTrue(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) )", config));
-    }
-    
-}
+package com.alibaba.druid.bvt.filter.wall;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallConfig;
+import com.alibaba.druid.filter.wall.WallUtils;
+
+import junit.framework.TestCase;
+
+/**
+ * 这个场景测试访问MySql系统表
+ * 
+ * @author admin
+ */
+public class MySqlWallPermitTableTest extends TestCase {
+
+    public void test_default() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) )"));
+    }
+    
+    public void test_allow() throws Exception {
+        WallConfig config = new WallConfig();
+        config.setTableCheck(false);
+        
+        Assert.assertTrue(WallUtils.isValidateMySql("select benchmark( 500000, sha1( 'test' ) )", config));
+    }
+    
+}
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java
new file mode 100644
index 0000000000..9ce18065d2
--- /dev/null
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/SQLServerWallPermitTableTest.java
@@ -0,0 +1,20 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.filter.wall.WallUtils;
+
+/**
+ * 这个场景测试访问SQLServer系统表
+ *
+ * @author RaymondXiu
+ * @version 1.0, 2012-3-18
+ * @see
+ */
+public class SQLServerWallPermitTableTest extends TestCase {
+    public void test_permitTable() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateSqlServer("select * from sysObjects"));
+    }
+}