asp SQL注入防范

将以下代码加在 数据库操作之前

 

 

<%
dim sql_injdata
SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
sql_inj = split(SQL_Injdata,"|")

if request.QueryString<>""  then
  for each  sql_get in request.QueryString
    for sql_data=0 to ubound(sql_inj)
      if  instr(request.QueryString(sql_get),sql_inj(sql_data))>0 then
        response.Write("<script>alert('go home!');history.back(-1);</script>")
        response.End()   
      end if
    next
  next
end if


if request.Form<>""  then
  for each  sql_get in request.Form
    for sql_data=0 to ubound(sql_inj)
      if  instr(request.QueryString(sql_get),sql_inj(sql_data))>0 then
        response.Write("<script>alert('go home!');history.back(-1);</script>")
        response.End()   
      end if
    next
  next
end if
%>