久久久电脑

SafeRequest 函数 代码：
Function SafeRequest(Key,Modes)
        Dim ParaValue,strFilter,FilterArr,i
        Select Case Lcase(Modes)
                Case "get"
                        ParaValue=Trim(Request.QueryString(Key))
                Case "post"
                        ParaValue=Trim(Request.Form(Key))
                Case "auto"
                        ParaValue=Trim(Request(Key))
        End Select
        IF IsNum(ParaValue) Then
                SafeRequest=ParaValue
                Exit Function
        Else     //如果获取的参数值不为数字  ，这检查是否包含以下关键字
            strFilter="'|and|(|)|exec|insert|select|delete|update|*|chr|mid|master|truncate|declare"  
                FilterArr=Split(strFilter,"|")
                For i=0 To Ubound(FilterArr)
                        IF Instr(ParaValue,FilterArr(i))>0 Then
                                ParaValue=ReplaceStr(ParaValue,FilterArr(i),DBC2SBC(FilterArr(i),0))
                        End IF
                Next
                SafeRequest=ParaValue
        End IF
        SafeRequest = FilterScript(SafeRequest)
End Function

没有考虑大小写

==================================

Function SafeRequest(ParaName,ParaType)
       Dim ParaValue
       ParaValue=Request(ParaName)
       If ParaType=1 then
              If not isNumeric(ParaValue) then
                     Response.write "<center>参数" & ParaName & "必须为数字型，请正确操作！</center>"
                     Response.end
              End if
       Else
              ParaValue=replace(ParaValue,"'","''")
       End if
       SafeRequest=ParaValue
End function

第二个else部分即当ParaType不为1时，只过滤参数中的单引号

============================================

saferequest()函数:

Function SafeRequest(ParaName)
Dim ParaValue
ParaValue=Request(ParaName)  //获取数据
if IsNumeric(ParaValue)  then  //如果是数字
SafeRequest=ParaValue  //那就不过滤，直接赋值
exit Function

else
ParaValuetemp=lcase(ParaValue)    //如果不是数字，先把接到的数据全部转为小写
tempvalue="select |insert |delete from|'|count(|drop table|update |truncate  |asc(|mid(|char(|xp_cmdshell|exec master|net localgroup administrators|net user| or | and |%20from"
//定义要过滤的字符！

他过滤方式有问题。。。没有过滤 * / % / -- / ;
而且他过滤的都是select+空格。我们用select%09或者select/**/便能饶过。