MSSQL Custom Function (filter string)

function | string

Create FUNCTION f_checkstring (@temp varchar (4000))
--f_checkstring is the method name
--@temp for parameter name varchar 4000 for type length
--Filtering SQL strings
RETURNS varchar (4000)
--The return type is varchar length 4000
As
BEGIN
Set @temp =replace (@temp, ' ",")
Set @temp =replace (@temp, ' "', ')
Set @temp =replace (@temp, ': ', ')
Set @temp =replace (@temp, '-', ')
Return @temp
End

--------------------------------------------------------------------------------------------
The method is invoked during the stored procedure in MSSQL as follows:

--Determine if the user name and password are correct
--exec Sp_checkuser
--2006-8-2
--dzend.com
Create PROCEDURE Sp_checkuser
@username varchar (20),--User name
@password varchar (20)--Password
As
Declare
@str varchar (20),
@result int,
@status int

--Filter illegal strings
Select @username =dbo.f_checkstring (@username)
Select @password =dbo.f_checkstring (@password)


Select @str =[password], @status =status from Usersinfo where Username= @username
If @ @rowcount =0
Set @result =-1-User name error
Else
Begin
If @status =1
Set @result =-3--account is locked
Else
Begin
If @str = @result
Set @result = 0--Login Successful
Else
Set @result =-2--Password error
End
End
Select @result
Go