How to prevent SQL injection

Mainly to prevent several areas of asp:
First, the address bar parameter injection, is to use Request.QueryString to get the value of this
Second, the form parameter injects, is uses the Request.Form to obtain the value the
Third, cookies
In fact, can be regarded as a rationale, is able to enter the value, can interact with the user input to the place to do a bit of defense.

Do a function, intercept the values submitted by these places, and compare them with an array (which contains sensitive characters to filter or check)

Give me one more filter function.

The following is a reference fragment: Function Chkstr (STR) If Isnull (STR) Then Chkstr = "" Exit Function End If STR = Replace (STR,CHR (0), "", 1,-1, 1) str = Replace (str, "" "," "", 1,-1, 1) str = Replace (str, "<", "<", 1,-1, 1) str = Replace (str, ">", ">", 1,-1, 1) str = Replace (str, "script", "script", 1,-1, 0) str = Replace (str, "script", "script", 1,-1, 0) str = Replace (str, "script", "script", 1,-1, 0) str = Replace (str, "script", "script", 1,-1, 1) str = Replace (str, "Object", "Object", 1,-1, 0) str = Replace (str, "Object", "Object", 1,-1, 0) str = Replace (str, "Object", "Object", 1,-1, 0) str = Replace (str, "Object", "Object", 1,-1, 1) str = Replace (str, applet, applet, 1,-1, 0) str = Replace (str, applet, applet, 1,-1, 0) str = Replace (str, applet, applet, 1,-1, 0) str = Replace (str, applet, applet, 1,-1, 1) str = Replace (str, "[", "[") str = Replace (str, "]", "]") str = Replace (str, "=", "=", 1,-1, 1) str = Replace (str, "'", "'", 1,-1, 1) str = Replace (str, "select", "select", 1,-1, 1) str = Replace (str, "Execute", "execute", 1,-1, 1) str = Replace (str, "exec", "exec", 1,-1, 1) str = Replace (str, "join", "join", 1,-1, 1) str = Replace (str, "union", "union", 1,-1, 1) str = Replace (str, "where", "where", 1,-1, 1) str = Replace (str, INSERT, INSERT, 1,-1, 1) str = Replace (str, "delete", "delete", 1,-1, 1) str = Replace (str, "Update", "Update", 1,-1, 1) str = Replace (str, "like", "like", 1,-1, 1) str = Replace (str, "Drop", "drop", 1,-1, 1) str = Replace (str, "create", "create", 1,-1, 1) str = Replace (str, "rename", "Rename", 1,-1, 1) str = Replace (str, "Count", "Count", 1,-1, 1) str = Replace (str, "CHR", "Chr", 1,-1, 1) str = Replace (str, "Mid", "mid", 1,-1, 1) str = Replace (str, "truncate", "truncate", 1,-1, 1) str = Replace (str, "nchar", "nchar", 1,-1, 1) str = Replace (str, "char", "char", 1,-1, 1) str = Replace (str, "ALTER", "Alter", 1,-1, 1) str = Replace (str, "cast", "cast", 1,-1, 1) str = Replace (str, "exists", "exists", 1,-1, 1) STR = Replace (Str,vbcrlf, "", 1,-1, 1) str = Replace (str, "", "", 1,-1, 1) Chkstr = Str End Function

Use:
When updating data, RS ("field") = chkstr (trim (request.form ("form parameter"))