The file can be included in any ASP files that need to call the database head, directly to the illegal injection

Data | Database <% ' This file can be included in any ASP files that need to call the database head, directly to get rid of illegal injection
' Call method is:<!--#include file= ' safe.asp '-->
function Safe (str) ' It is used to determine whether a variable passed over contains special characters and does not return true
Dim s_badstr, N, I
S_badstr = "' &<>?%,;:() ' ~!@#$^*{}[]|\/+-= ' &AMP;CHR (&AMP;CHR) (9) &AMP;CHR (32)
n = Len (S_BADSTR)
Safe = True
For i = 1 to n
If Instr (str, Mid (S_BADSTR, I, 1)) > 0 Then
Safe = False
Exit Function
End If
Next
End Function
' The following code directly determines whether the URL in which the request occurred contains illegal characters
On Error Resume Next
Dim strtemp

If LCase (Request.ServerVariables ("HTTPS") = "Off" Then
strtemp = "http://"
Else
strtemp = "https://"
End If
strtemp = strtemp & Request.ServerVariables ("SERVER_NAME")
If Request.ServerVariables ("Server_port") <> Then strtemp = strtemp & ":" & Request.ServerVariables ("SER Ver_port ")
strtemp = strtemp & Request.ServerVariables ("URL")
If Trim (request.querystring) <> "" Then strtemp = strtemp & "?" & Trim (Request.QueryString)
strtemp = LCase (strtemp)
If Instr (strtemp, "select%20") or Instr (strtemp, "insert%20") or Instr (strtemp, "Delete%20from") or Instr (strtemp, "Count (") or Instr (strtemp," drop%20table ") or Instr (strtemp," update%20 ") or Instr (strtemp," truncate%20 ") or Instr (strtemp," ASC (") or Instr (strtemp, Mid () or INSTR (strtemp," char (") or Instr (strtemp," xp_cmdshell ") or Instr (strtemp," exec% ") 20master ") or Instr (strtemp," net%20localgroup%20administrators ") or Instr (strtemp," db_name (") or Instr (strtemp," net% ") 20user ") or Instr (strtemp," ") or Instr (strtemp,"%20or ") or Instr (strtemp," backup%20 ") Then
Response.Write "<script language= ' JavaScript ' >"
Response.Write "Alert (' Illegal address!!) ');"
Response.Write "location.href= ' http://www.myzone.cn ';"
Response.Write "</script>"
End If

For each name in Request.Form
Dim S_badstr, S_SZ, I
S_badstr = "' |and|select|update|chr|delete|from|;| insert|mid|master.| Truncate|db_name|xp_cmdshell|exec%20master|net%20localgroup%20administrators|drop|table|db_name (|exec "
S_SZ = Split (S_badstr, "|")
For i = 0 To UBound (S_SZ)
If Instr (Request.Form (name), S_SZ (i)) > 0 Then
Response.Write "<script language= ' JavaScript ' >"
Response.Write "Alert (' Illegal address!!) ');"
Response.Write "location.href= ' http://www.myzone.cn ';"
Response.Write "</script>"
End If
Next
Next
%>