自己写一个防止SQL注入函数 - 中国WEB开发者网络 (http://www.webasp.net) -- 技术教程 (http://www.webasp.net/article/) --- 自己写一个防止SQL注入函数 (http://www.webasp.net/article/17/16564.htm)

-- 作者：未知 -- 发布日期： 2005-02-22

<% function sqlcheck(Str,errtype) if Instr(LCase(Str),"select ") > 0 or Instr(LCase(Str),"insert ") > 0 or Instr(LCase(Str),"delete ") > 0 or Instr(LCase(Str),"delete from ") > 0 or Instr(LCase(Str),"count(") > 0 or Instr(LCase(Str),"drop table") > 0 or Instr(LCase(Str),"update ") > 0 or Instr(LCase(Str),"truncate ") > 0 or Instr(LCase(Str),"asc(") > 0 or Instr(LCase(Str),"mid(") > 0 or Instr(LCase(Str),"char(") > 0 or Instr(LCase(Str),"xp_cmdshell") > 0 or Instr(LCase(Str),"exec master") > 0 or Instr(LCase(Str),"net localgroup administrators") > 0 or Instr(LCase(Str),"and ") > 0 or Instr(LCase(Str),"net user") > 0 or Instr(LCase(Str),"or ") > 0 then Response.write("<script language=javascript>" & vbcrlf & "window.location.href ='ShowError.asp?errtype=" & errtype & "'" & vbcrlf & "</script>") Response.End end if Str=Replace(Str,"_","") '过滤SQL注入_ Str=Replace(Str,"*","") '过滤SQL注入* Str=Replace(Str," ","") '过滤SQL注入空格 Str=Replace(Str,chr(34),"") '过滤SQL注入" Str=Replace(Str,chr(39),"") '过滤SQL注入' Str=Replace(Str,chr(91),"") '过滤SQL注入[ Str=Replace(Str,chr(93),"") '过滤SQL注入] Str=Replace(Str,chr(37),"") '过滤SQL注入% Str=Replace(Str,chr(58),"") '过滤SQL注入: Str=Replace(Str,chr(59),"") '过滤SQL注入; Str=Replace(Str,chr(43),"") '过滤SQL注入+ Str=Replace(Str,"{","") '过滤SQL注入{ Str=Replace(Str,"}","") '过滤SQL注入} sqlcheck=Str '返回经过上面字符替换后的Str end function %>

webasp.net