被动防SQL注入

<%
call sql_into_check() '调用ql防注入代码2008-05-14 kz

'=================sql防注入代码=============================2008-05-14 kz
sub sql_into_check()
dim sql_injdata
SQL_injdata = "'|;|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"'过滤字符
SQL_inj = split(SQL_Injdata,"|")

if pageName()="xxx.asp" or pageName()="xxx1.asp" or pageName()="xxx2.asp"  then
'路过
else

 If Request.Form<>"" Then
  For Each Sql_Post In Request.Form
   For SQL_Data=0 To Ubound(SQL_inj)
    if instr(lcase(Request.Form(Sql_Post)),Sql_Inj(Sql_DATA))>0 Then
     Response.Write "<Script Language=JavaScript>alert('SQL防注入提示：/n你提交了非法字符,此次提交失败!');history.back(-1);</Script>"
     Response.end
    end if
   next
  next
 end if
end if

If Request.QueryString<>"" Then
 For Each SQL_Get In Request.QueryString
  For SQL_Data=0 To Ubound(SQL_inj)
   if instr(lcase(Request.QueryString(SQL_Get)),Sql_Inj(Sql_DATA))>0 Then
    Response.Write "<Script Language=JavaScript>alert('SQL防注入提示：/n你提交了非法字符,此次提交失败!');history.back(-1);</Script>"
    Response.end
   end if
  next
 Next
End If
end sub

'过滤涵数2008-05-15 by kz
Function CheckNumeric(Number)
If Not IsNumeric(Number)  then
CheckNumeric = 0
Else
CheckNumeric = Number
End If
End Function

Function Checkstr(Str)
If Isnull(Str) Then
CheckStr = ""
Exit Function 
End If
Str = Replace(Str,Chr(0),"")
CheckStr = Replace(Str,"'","''")
End Function

Public Function pageName()
  Dim url,urlParts
  url = Request.ServerVariables("SCRIPT_NAME")
  urlParts = Split(url,"/")
  pageName = urlParts(UBound(urlParts))
 End Function

%>