防止SQL注入的函数（转）

Function CheckStr(byVal ChkStr) '检查无效字符
        Dim Str:Str=ChkStr
        Str=Trim(Str)
        If IsNull(Str) Then
                CheckStr = ""
                Exit Function
        End If
        Dim re
        Set re=new RegExp
        re.IgnoreCase =True
        re.Global=True
        re.Pattern="(/r/n){3,}"
        Str=re.Replace(Str,"$1$1$1")
        Set re=Nothing
        Str = Replace(Str,"'","''")
        Str = Replace(Str, "select", "select")
        Str = Replace(Str, "join", "join")
        Str = Replace(Str, "union", "union")
        Str = Replace(Str, "where", "where")
        Str = Replace(Str, "insert", "insert")
        Str = Replace(Str, "delete", "delete")
        Str = Replace(Str, "update", "update")
        Str = Replace(Str, "like", "like")
        Str = Replace(Str, "drop", "drop")
        Str = Replace(Str, "create", "create")
        Str = Replace(Str, "modify", "modify")
        Str = Replace(Str, "rename", "rename")
        Str = Replace(Str, "alter", "alter")
        Str = Replace(Str, "cast", "cast")
        CheckStr=Str
End Function

对于request.querystring的字符串要加这个函数，转过来的，不知道是不是确实有用。

原帖 http://blog.csdn.net/KimYoo/archive/2005/03/05/312154.aspx