SQL防注入公用代码

<%
dim SQL_injdata,SQL_inj
SQL_injdata="'|and|or|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
SQL_inj=split(SQL_injdata,"|")
If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Lcase(Request.QueryString(SQL_Get)),Sql_Inj(SQL_Data))>0 Then
Response.Write "<Script Language='JavaScript'>history.back(-1);</Script>"
Response.end
end if
Next
Next
End If
If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Lcase(Request.Form(Sql_Post)),Sql_Inj(SQL_Data))>0 Then
Response.Write "<Script Language='JavaScript'>history.back(-1);</Script>"
Response.end
end if
Next
Next
End if
IF isNumeric(Request.QueryString("ID"))=False Then
Response.Write "<Script Language='JavaScript'>history.back(-1);</Script>"
End if
%>