過濾SQL非法字元

public string filtRiskChar(string str) //過濾非法字元
    {
        string s = "";

        s = str.Replace("'", " ");
        s = s.Replace(";", " ");
        s = s.Replace("1=1", " ");
        s = s.Replace("|", " ");
        s = s.Replace("<", " ");
        s = s.Replace(">", " ");

        return s;
    }

public boolean checkParameter(String para) //檢測非法字元
    ...{
        int flag = 0;
         flag += para.indexOf("'") + 1;
         flag += para.indexOf(";") + 1;
         flag += para.indexOf("1=1") + 1;
         flag += para.indexOf("|") + 1;
         flag += para.indexOf("<") + 1;
         flag += para.indexOf(">") + 1;
        if (flag != 0)
        ...{
             System.out.println("提交了非法字元!!!");
            return false;
         }
        return true;
     }

////////////////////////////////////////////////////////////////////////////////

'過濾SQL非法字元並格式化html代碼
function Replace_Text(fString)
if isnull(fString) then
Replace_Text=""
exit function
else
fString=trim(fString)
fString=replace(fString,"'","''")
fString=replace(fString,";","；")
fString=replace(fString,"--","—")
fString=server.htmlencode(fString)
Replace_Text=fString
end if
end function

function changechr(str)
changechr=replace(replace(replace(replace(str,"<","&lt;"),">","&gt;"),chr(13),"<br>")," ","&nbsp;")
changechr=replace(replace(replace(replace(changechr,"[sayyes]","<div align=center><img src="),"","<b>"),"[red]","<font color=CC0000>"),"[big]","<font size=7>")
changechr=replace(replace(replace(replace(changechr,"[/sayyes]","></img></div>"),"","</b>"),"[/red]","</font>"),"[/big]","</font>")
end function

 

'會員發布的各種資訊過濾
'Function Replace_Text(fString)
'If Not IsNull(fString) Then
'fString = trim(fString)
'fString = replace(fString, ";", "；")     '分號過濾
'fString = replace(fString, "--", "——") '--過濾
'fString = replace(fString, "%20", "")    '特殊字元過濾
'fString = replace(fString, "==", "")     '==過濾
'fString = replace(fString, ">", "&gt;")
'fString = replace(fString, "<", "&lt;")
'fString = Replace(fString, CHR(32), " ")   '&nbsp;
'fString = Replace(fString, CHR(9), " ")    '&nbsp;
'fString = Replace(fString, CHR(34), "&quot;")
'fString = Replace(fString, CHR(39), "'") '單引號過濾
'fString = Replace(fString, CHR(13), "")
'fString = Replace(fString, CHR(10) & CHR(10), "</P><P> ")
'fString = Replace(fString, CHR(10), "<BR> ")
'Replace_Text = fString
'End If
'End Function

'過濾SQL非法字元
Function checkStr(Chkstr)
dim Str:Str=Chkstr
if isnull(Str) then
   checkStr = ""
   exit Function
else
   Str=replace(Str,"'","")
   Str=replace(Str,";","")
   Str=replace(Str,"--","")
   checkStr=Str
end if
End Function

'檢測傳遞的參數是否為數字型
Function Chkrequest(Para)
Chkrequest=False
If Not (IsNull(Para) or Trim(Para)="" or Not IsNumeric(Para)) Then
    Chkrequest=True
End If
End Function

'檢測傳遞的參數是否為日期型
Function Chkrequestdate(Para)
Chkrequestdate=False
If Not (IsNull(Para) or Trim(Para)="" or Not IsDate(Para)) Then
    Chkrequestdate=True
End If
End Function

'得到當前頁面的地址
Function GetUrl()
On Error Resume Next
Dim strTemp
If LCase(Request.ServerVariables("HTTPS")) = "off" Then
strTemp = "http://"
Else
strTemp = "https://"
End If
strTemp = strTemp & CheckStr(Request.ServerVariables("SERVER_NAME"))
If Request.ServerVariables("SERVER_PORT") <> 80 Then strTemp = strTemp & ":" & CheckStr(Request.ServerVariables("SERVER_PORT"))
strTemp = strTemp & CheckStr(Request.ServerVariables("URL"))
If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & CheckStr(Trim(Request.QueryString))
GetUrl = strTemp
End Function

'Function CheckReferer()   '檢查使用者是否在瀏覽器裡輸入了本頁的地址
'     Dim sReferer, Icheck
'     CheckReferer = True
'     sReferer = Request.ServerVariables("HTTP_REFERER")
'     ServerIP = Request.ServerVariables("LOCAL_ADDR")
'     Icheck = InStr(sReferer, "ServerIP")
'     If Icheck = 0 Then
'     CheckReferer = False
'     End If
'End Function

'日期格式化
Function FormatDate(DT,tp)
dim Y,M,D
Y=Year(DT)
M=month(DT)
D=Day(DT)
if M<10 then M="0"&M
if D<10 then D="0"&D
select case tp
case 1 FormatDate=Y&"年"&M&"月"&D&"日"
case 2 FormatDate=Y&"-"&M&"-"&D
end select
End Function