sql防注入程序

不改变原字符显示!
如select*替换为select*
这样既不损坏数据,也安全!
没有想到的地方请大家指正

<%
Response.Write CheckRequest("str")

' ============================================
' 检测传入变量,防止SQL注入
' ============================================
Function CheckRequest(ByVal strRequest)
      Dim ParaValue, aBadUalueb, bBadValue, inBad, strBad
      If strRequest = "" Then
         CheckRequest = ""
         Exit Function
      End If
      ParaValue = Request(strRequest)
      If ParaValue = "" Then
         CheckRequest = ""
         Exit Function
      End If
      aBadValue = "net user|net localgroup administrators|xp_cmdshell|/add|exec%20master.dbo.xp_cmdshell|" & Chr(0) & ""
      aValueArr = Split(aBadValue, "|")
      For a = 0 To UBound(aValueArr)
         If InStr(LCase(ParaValue), aValueArr(a)) <> 0 Then
            ParaValue = Replace(ParaValue, aValueArr(a), strFToAsc(aValueArr(a)), 1, -1, vbTextCompare)
         End If
      Next

      bBadUalue = "and|exec|insert|select|delete|update|count|chr|mid|master|truncate|char|declare|drop|from|or"
      inBad = "(|)|[|]| |*|%20"
      bValueArr = Split(bBadUalue, "|")
      iBad = Split(inBad, "|")
      For b = 0 To UBound(bValueArr)
         strBad = bValueArr(b)
         For i = 0 To UBound(iBad)
            Fstr = strBad & iBad(i)
            If InStr(LCase(ParaValue), Fstr) <> 0 Then
                  ParaValue = Replace(ParaValue, Fstr, strFToAsc(Fstr), 1, -1, vbTextCompare)
            End If
            Lstr = iBad(i) & strBad
            If InStr(LCase(ParaValue), Lstr) <> 0 Then
                  ParaValue = Replace(ParaValue, Lstr, strFToAsc(Lstr), 1, -1, vbTextCompare)
            End If
         Next
      Next

      CheckRequest = ParaValue
End Function
' ============================================
' 首字符转换成Html码
' ============================================
Function strFToAsc(ByVal strValue)
      Dim strTemp
      strTemp = strValue
      If strTemp = "" Then
         strFToAsc = ""
         Exit Function
      End If
      strTemp = "&#" & Asc(Left(strTemp, 1)) & ";" & Right(strTemp, Len(strTemp) - 1)
      strFToAsc = strTemp
End Function
%>

补充：asp教程,安全加密