自己寫一個防止SQL注入函數

<%
function sqlcheck(Str,errtype)
if Instr(LCase(Str),"select ") > 0 or Instr(LCase(Str),"insert ") > 0 or Instr(LCase(Str),"delete ") > 0 or Instr(LCase(Str),"delete from ") > 0 or Instr(LCase(Str),"count(") > 0 or Instr(LCase(Str),"drop table") > 0 or Instr(LCase(Str),"update ") > 0 or Instr(LCase(Str),"truncate ") > 0 or Instr(LCase(Str),"asc(") > 0 or Instr(LCase(Str),"mid(") > 0 or Instr(LCase(Str),"char(") > 0 or Instr(LCase(Str),"xp_cmdshell") > 0 or Instr(LCase(Str),"exec master") > 0 or Instr(LCase(Str),".net localgroup administrators") > 0 or Instr(LCase(Str),"and ") > 0 or Instr(LCase(Str),"net user") > 0 or Instr(LCase(Str),"or ") > 0 then
Response.write("<script language=javascript>" & vbcrlf & "window.location.href =@#ShowError.asp?errtype=" & errtype & "@#" & vbcrlf & "</script>")
Response.End
end if
Str=Replace(Str,"_","") @#過濾SQL注入_
Str=Replace(Str,"*","") @#過濾SQL注入*
Str=Replace(Str," ","") @#過濾SQL注入空格
Str=Replace(Str,chr(34),"") @#過濾SQL注入"
Str=Replace(Str,chr(39),"") @#過濾SQL注入@#
Str=Replace(Str,chr(91),"") @#過濾SQL注入[
Str=Replace(Str,chr(93),"") @#過濾SQL注入]
Str=Replace(Str,chr(37),"") @#過濾SQL注入%
Str=Replace(Str,chr(58),"") @#過濾SQL注入:
Str=Replace(Str,chr(59),"") @#過濾SQL注入;
Str=Replace(Str,chr(43),"") @#過濾SQL注入+
Str=Replace(Str,"{","") @#過濾SQL注入{
Str=Replace(Str,"}","") @#過濾SQL注入}
sqlcheck=Str @#返回經過上面字符替換后的Str
end function
%>

原文轉自：http://www.kjueaiud.com