Code release! Two small functions make your ASP program immune to SQL injection!

Rem # Long integer conversion
Function toNum (s, default)
If IsNumeric (s) and s <> "then
ToNum = CLng (s)
Else
ToNum = default
End If
End Function

Rem # SQL statement conversion
Function toSql (str)
If IsNull (str) Then str = ""
ToSql = replace (str ,"'","''")
End Function

Example:
Dim SQL
Dim strWhere, strName, intAge
StrName = toSql (request ("user "))
IntAge = toNum (request ("age"), 20)
SQL = "SELECT * FROM [USER]" & _
"WHERE [AGE]>" & strName &_
"AND [USERNAME] = '" & intAge &"'"
In general, the above two functions can be used to prevent online SQL injection attacks! If you need it, you can replace chr (0) and change the toSql function as follows:
Function toSql (str)
If IsNull (str) Then str = ""
Str = replace (str, chr (0 ),"")
ToSql = replace (str ,"'","''")
End Function
Note:
**************************************** *******************************
Checks externally submitted functions.
Function CheckUrlRefer ()
Dim strLocalUrl, intUrlLen, strUrlRefer
StrLocalUrl = "http: // 127.0.0.1"
IntUrlLen = Len (strLocalUrl)
StrUrlRefer = LCase (request. ServerVariables ("HTTP_REFERER ")&"")
'Check whether the previous page is from strLocalUrl
If Left (strUrlRefer, intUrlLen) = strLocalUrl Then
CheckUrlRefer = True
Else
CheckUrlRefer = False
End If
End Function
**************************************** *******************************
This function can help you resist external SQL injection tests. You only need to call this function in the header of the page.