asp sql超级防注入代码

asp sql超级防注入代码

<%Function Safe(str)
Dim s_BadStr, n, i
s_BadStr = "' 　&<>?%,;)`~!@#$^*{}[]|/+-="&Chr(34)&Chr(9)&Chr(32)
n = Len(s_BadStr)
Safe = True
For i = 1 To n
If Instr(str, Mid(s_BadStr, i, 1)) > 0 Then
Safe = False
Exit Function
End If
Next
End Function
'以下代码直接判断发生请求的URL是否包含非法字符
On Error Resume Next
Dim strTemp

If LCase(Request.ServerVariables("HTTPS")) = "off" Then
strTemp = "http://"
Else
strTemp = "https://"
End If
strTemp = strTemp & Request.ServerVariables("SERVER_NAME")
If Request.ServerVariables("SERVER_PORT") <> 80 Then strTemp = strTemp & ":" & Request.ServerVariables("SERVER_PORT")
strTemp = strTemp & Request.ServerVariables("URL")
If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & Trim(Request.QueryString)
strTemp = LCase(strTemp)
If Instr(strTemp,"select%20") or Instr(strTemp,"insert%20") or Instr(strTemp,"delete%20from") or Instr(strTemp,"count(") or Instr(strTemp,"drop%20table") or Instr(strTemp,"update%20") or Instr(strTemp,"truncate%20") or Instr(strTemp,"asc(") or Instr(strTemp,"mid(") or Instr(strTemp,"char(") or Instr(strTemp,"xp_cmdshell") or Instr(strTemp,"exec%20master") or Instr(strTemp,"net%20localgroup%20administrators") or Instr(strTemp,"db_name(") or Instr(strTemp,"net%20user") or Instr(strTemp,"'") or Instr(strTemp,"%20or") or Instr(strTemp,"backup%20") then
Response.Write ""
End If

if Request.Form<>"" Then
For Each name In Request.Form
Dim s_BadStr, s_Sz, i
s_BadStr = "'|and|select|update|chr|delete|from|;|insert|mid|master.|truncate|db_name|xp_cmdshell|exec%20master|net%20localgroup%20administrators|drop|table|db_name(|exec"
s_Sz = split(s_BadStr,"|")
For i = 0 To ubound(s_Sz)
If Instr(Request.Form(name), s_Sz(i)) > 0 Then
response.write Request.Form(name)
response.end
Response.Write ""
End If
Next
next
end if
%>

If Instr(strTemp,"select%20") or Instr(strTemp,"insert%20") or Instr(strTemp,"delete%20from") or Instr(strTemp,"count(") or Instr(strTemp,"drop%20table") or Instr(strTemp,"update%20") or Instr(strTemp,"truncate%20") or Instr(strTemp,"asc(") or Instr(strTemp,"mid(") or Instr(strTemp,"char(") or Instr(strTemp,"xp_cmdshell") or Instr(strTemp,"exec%20master") or Instr(strTemp,"net%20localgroup%20administrators") or Instr(strTemp,"db_name(") or Instr(strTemp,"net%20user") or Instr(strTemp,"'") or Instr(strTemp,"%20or") or Instr(strTemp,"backup%20") then
Response.Write ""
End If

if Request.Form<>"" Then
For Each name In Request.Form
Dim s_BadStr, s_Sz, i
s_BadStr = "'|and|select|update|chr|delete|from|;|insert|mid|master.|truncate|db_name|xp_cmdshell|exec%20master|net%20localgroup%20administrators|drop|table|db_name(|exec"
s_Sz = split(s_BadStr,"|")
For i = 0 To ubound(s_Sz)
If Instr(Request.Form(name), s_Sz(i)) > 0 Then
response.write Request.Form(name)
response.end
Response.Write ""
End If
Next
next
end if
这段代码有问题 一点击保存 就提示非法地址，我提交的表单也没有'|and|select|update|chr|delete|from|;|insert|mid|master.|truncate|db_name|xp_cmdshell|exec%20master|net%20localgroup%20administrators|drop|table|db_name(|exec 类似的字符啊！