我用的过滤字符函数

 推荐过滤“& ; ` ' / ” | * ? ~ < > ^ ( ) [ ] { } $ /n /r /t /0 # ../；

 

<%
function killbad(strchar)

strchar=replace(strchar,"?","？")
strchar=replace(strchar,"*","＊")
strchar=replace(strchar,"'","‘")
strchar=replace(strchar,";","；")
strchar=replace(strchar,":","：")
strchar=replace(strchar,chr(34),"“")
strchar=replace(strchar,".","。")
strchar=replace(strchar,"(","（")
strchar=replace(strchar,")","）")
strchar=replace(strchar,"@","＠")
strchar=replace(strchar,"%","％")
strchar=replace(strchar,"&","＆")
strchar=replace(strchar,"-","－")
strchar=replace(strchar,"<","＜")
strchar=replace(strchar,">","＞")
strchar=replace(strchar,"+","＋")
killbad=strchar
end function

'定义过滤html字符
function htmlencode(hstring)
if not isnull(hstring) then
hstring=replace(hstring,"<","&lt;")
hstring=replace(hstring,">","&gt;")
hstring=replace(hstring,chr(32),"&nbsp;")
hstring=replace(hstring,chr(34),"&quot;")
hstring=replace(hstring,chr(9),"&nbsp;")
hstring=replace(hstring,chr(39),"#&39;")
hstring=replace(hstring,chr(10)&chr(10),"<br>")
hstring=replace(hstring,chr(10),"<br>")
hstring=replace(hstring,chr(13),"")
htmlencode=hstring
end if
end function

function chkstr(str)
str=killbad(str)
str=htmlencode(str)
chkstr=str
end function
%>