过滤sql特殊字符

function POP_sqlin(text)  
  if isnull(text) then
    POP_sqlin=""
    exit function
  end if

  dim Sqlwords
  Set Sqlwords=new RegExp
  Sqlwords.IgnoreCase =True
  Sqlwords.Global=True

  Sqlwords.Pattern="(')"
  text=Sqlwords.Replace(text,"''")
  Sqlwords.Pattern="(;)"
  text=Sqlwords.Replace(text,"；")
  Sqlwords.Pattern="(%)"
  text=Sqlwords.Replace(text,"％")
  Sqlwords.Pattern="(and)"
  text=Sqlwords.Replace(text,"ａｎｄ")
  Sqlwords.Pattern="(exec)"
  text=Sqlwords.Replace(text,"ｅｘｅｃ")
  Sqlwords.Pattern="(execute)"
  text=Sqlwords.Replace(text,"ｅｘｅｃｕｔｅ")
  Sqlwords.Pattern="(insert)"
  text=Sqlwords.Replace(text,"ｉｎｓｅｒｔ")
  Sqlwords.Pattern="(select)"
  text=Sqlwords.Replace(text,"ｓｅｌｅｃｔ")
  Sqlwords.Pattern="(delete)"
  text=Sqlwords.Replace(text,"ｄｅｌｅｔｅ")
  Sqlwords.Pattern="(update)"
  text=Sqlwords.Replace(text,"ｕｐｄａｔｅ")
  Sqlwords.Pattern="(count)"
  text=Sqlwords.Replace(text,"ｃｏｕｎｔ")
  Sqlwords.Pattern="(chr)"
  text=Sqlwords.Replace(text,"ｃｈｒ")
  Sqlwords.Pattern="(mid)"
  text=Sqlwords.Replace(text,"ｍｉｄ")
  Sqlwords.Pattern="(master)"
  text=Sqlwords.Replace(text,"ｍａｓｔｅｒ")
  Sqlwords.Pattern="(truncate)"
  text=Sqlwords.Replace(text,"ｔｒｕｎｃａｔｅ")
  Sqlwords.Pattern="(char)"
  text=Sqlwords.Replace(text,"ｃｈａｒ")
  Sqlwords.Pattern="(declare)"
  text=Sqlwords.Replace(text,"ｄｅｃｌａｒｅ")

  Set Sqlwords=Nothing
  POP_sqlin = text
end function

function POP_sqlout(text)  
  if isnull(text) then
    POP_sqlout=""
    exit function
  end if
  text = Replace(text,"''","'")
  text = Replace(text,"；",";")
  text = Replace(text,"％","%")
  text = Replace(text,"ａｎｄ","and")
  text = Replace(text,"ｅｘｅｃ","exec")
  text = Replace(text,"ｅｘｅｃｕｔｅ","execute")
  text = Replace(text,"ｉｎｓｅｒｔ","insert")
  text = Replace(text,"ｓｅｌｅｃｔ","select")
  text = Replace(text,"ｄｅｌｅｔｅ","delete")
  text = Replace(text,"ｕｐｄａｔｅ","update")
  text = Replace(text,"ｃｏｕｎｔ","count")
  text = Replace(text,"ｃｈｒ","chr")
  text = Replace(text,"ｍｉｄ","mid")
  text = Replace(text,"ｍａｓｔｅｒ","master")
  text = Replace(text,"ｔｒｕｎｃａｔｅ","truncate")
  text = Replace(text,"ｃｈａｒ","char")
  text = Replace(text,"ｄｅｃｌａｒｅ","declare")
  POP_sqlout = text
end function

function HTMLEncode(popstring)
  if not isnull(popstring) then
  popstring = POP_sqlout(popstring)
  popstring = replace(popstring, ">", ">")
  popstring = replace(popstring, "<", "<")
  popstring = Replace(popstring, CHR(32), " ")
  popstring = Replace(popstring, CHR(9), " ")
  popstring = Replace(popstring, CHR(34), """)
  popstring = Replace(popstring, CHR(39), "'")
  popstring = Replace(popstring, CHR(10) & CHR(10), "</p><p> ")
  popstring = Replace(popstring, CHR(10), "<br /> ")
  popstring = Replace(popstring, CHR(36), "$")
  HTMLEncode = popstring
  end if
end function