ASP过虑非法字符,SQL防注入函数,禁止非法提交

<%
'==============================================================检查提交数据合法性
Function CheckInput()
'--------定义部份------------------
Dim Fy_Post,Fy_Get,Fy_In,Fy_Inf,Fy_Xh,Fy_db,Fy_dbstr,Kill_IP,WriteSql
'自定义需要过滤的字串,用 "|" 分隔
Fy_In = "'|;|and|(|)|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"

Fy_Inf = split(Fy_In,"|")
'--------POST部份------------------
If Request.Form <> "" Then
   For Each Fy_Post In Request.Form
    For Fy_Xh = 0 To Ubound(Fy_Inf)
     If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh)) <> 0 Then
      Echo "<Script Language=JavaScript>alert('请不要在参数中包含非法字符！');history.go(-1);</Script>"
      Response.End
     End If
    Next
   Next
End If
'----------------------------------

'--------GET部份-------------------
If Request.QueryString <> "" Then
   For Each Fy_Get In Request.QueryString
    For Fy_Xh = 0 To Ubound(Fy_Inf)
     If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh)) <> 0 Then
      Echo "<Script Language=JavaScript>alert('请不要在参数中包含非法字符！');history.go(-1);</Script>"
      Response.End
     End If
    Next
   Next
End If
End Function
%>

*****************************************

'************** ASPSecurity SQL 防注入**************
' Copyright 2006
' Create:2006-4-06
' Update:2006-4-14
'***************************************************

If Request.Form<>"" Then StopInjection(Request.Form)

If Request.QueryString<>"" Then StopInjection(Request.QueryString)

If Request.Cookies<>"" Then StopInjection(Request.Cookies)

Function StopInjection(values)
For Each N_Get In values
   Dim L_Get, L_Get2
   For Each L_Get In values
    L_Get2 = values(L_Get)
    Set regEx = New RegExp
    regEx.IgnoreCase = True
    regEx.Global = True
    regEx.Pattern = "(/bselect/b|/sand/s|'|;|/sdeclare/s)"
    If regEx.Test(L_Get2) Then
     Alert()
     response.End()
    End If
    Set regEx = Nothing
   Next
Next
End Function

Sub Alert()
Dim str
str = "<"&"Script Language=JavaScript"&">"
str = str & "alert('搜搜看看网安全助手检测到了危险字符，已经禁止本次提交 ==/n');window.close();"
str = str & "<"&"/Script"&">"
response.write   str
End Sub