ASP SQL注入

<%
'**************************************************
'函數名：ReplaceBadChar
'作  用：過濾非法的SQL字元
'參  數：strChar-----要過濾的字元
'傳回值：過濾後的字元
'來源：www.coredata.cn
'**************************************************
Function ReplaceBadChar(strChar)
    If strChar = "" Or IsNull(strChar) Then
        ReplaceBadChar = ""
        Exit Function
    End If
    Dim strBadChar, arrBadChar, tempChar, i
    strBadChar = "',--,^,&,<,>,{,},\," & Chr(34) & "," & Chr(0) & ""
    arrBadChar = Split(strBadChar, ",")
    tempChar = strChar
    For i = 0 To UBound(arrBadChar)
        tempChar = Replace(tempChar, arrBadChar(i), "")
    Next
    tempChar = Replace(tempChar, "@@", "@")
    ReplaceBadChar = tempChar
End Function
%>