ASP generic anti-injection code. Eliminate SQL injection hidden dangers. Enhance site security

ASP generic anti-injection code. Eliminate SQL injection hidden dangers. Enhance site security

<%
''''''''''''''''''''''''''''''''''''''''''''''''
' ASP generic anti-injection code
' You can copy the code into the header file. You can do it alone.
' exists for a file, each invocation uses
' Author: y3gu-2005-7-29
''''''''''''''''''''''''''''''''''''''''''''''''
Dim Getflag Rem (Submitted by way)
Dim errorsql Rem (illegal character)
Dim Requestkey Rem (submit data)
Dim fori Rem (circular marker)
Errorsql = "' ~;~and~ (~) ~exec~update~count~*~%~chr~mid~master~truncate~char~declare" Rem (use half angle "~" for each sensitive character or word)
Errorsql = Split (Errorsql, "~")
If Request.ServerVariables ("request_method") = "Get" Then
Getflag=true
Else
Getflag=false
End If
If Getflag Then
For each requestkey in Request.QueryString
For fori=0 to Ubound (errorsql)
If Instr (LCase (Request.QueryString (Requestkey)), Errorsql (fori)) <>0 Then
Response.Write "<script>alert (" "Warning: \ Please do not use sensitive characters" "); location.href=" sql.asp "";</script> "
Response.End
End If
Next
Next
Else
For each requestkey in Request.Form
For fori=0 to Ubound (errorsql)
If Instr (LCase (Request.Form (Requestkey)), Errorsql (fori)) <>0 Then
Response.Write "<script>alert (" "Warning: \ Please do not use sensitive characters" "); location.href=" sql.asp "";</script> "
Response.End
End If
Next
Next
End If
%>