防注入的办法

这是网上搜来的防注入的办法：
<%

'检查URL输入 限制非法字符
url=LCase(request.querystring())
ip=request.ServerVariables("REMOTE_ADDR")
pos1=instr(url,"%")
pos2=instr(url,"'")
pos3=instr(url,";")
pos4=instr(url,"where")
pos5=instr(url,"select")
pos6=instr(url,"chr")
pos7=instr(url,"/")
pos8=Instr(url,"and")
pos9=Instr(url,"update")
pos10=Instr(url,"delete")
pos11=Instr(url,"count")
if pos1<>0 or pos2<>0 or pos3<>0 or pos4<>0 or pos5<>0 or pos6<>0 or pos7<>0 or   pos8<>0 or pos9<>0 or pos10<>0 or pos11<>0 then
response.Write "你尝试使用危险字符,系统已经对此做了记录如下<Br>您的IP:"&ip&"<br>操作时间:"&date()&""
response.End()
end if

'检查表单输入，限制非法字符
'使用request.QueryString来索引request的所有资料,作为SQL检查之用
'如出现非法字符则自动停止输出
for i_request = 1 to request.form.Count
if instr(request.form(i_request),"'")<>0 or instr(request.form(i_request),";")<>0 or instr(request.form(i_request),"%")<>0 or instr(request.form(i_request),"where")<>0 or instr(request.form(i_request),"select")<>0 or instr(request.form(i_request),"chr")<>0 or instr(request.form(i_request),"/")<>0 or instr(request.form(i_request),"and")<>0 or instr(request.form(i_request),"update")<>0 or instr(request.form(i_request),"delete")<>0 or instr(request.form(i_request),"count")<>0 then
Response.Write "<script language='javascript'>history.back(); alert('你尝试使用危险字符,系统已经对此做了记录如下\n您的IP:"&ip&"\n操作时间:"&date()&"');</script>"
response.End()
end if
next

%>
把以上这些代码单独存在一个文件中，比如kdc.asp，然后在conn.asp中include一下就可以了。
注：如果是上传页面里，而且接收数据用的是upload.form()就不能用上面这段代码了。