过滤SQL非法字符

public string filtRiskChar(string str) //过滤非法字符
    {
        string s = "";

        s = str.Replace("'", " ");
        s = s.Replace(";", " ");
        s = s.Replace("1=1", " ");
        s = s.Replace("|", " ");
        s = s.Replace("<", " ");
        s = s.Replace(">", " ");

        return s;
    }

public boolean checkParameter(String para) //检测非法字符
    ...{
        int flag = 0;
         flag += para.indexOf("'") + 1;
         flag += para.indexOf(";") + 1;
         flag += para.indexOf("1=1") + 1;
         flag += para.indexOf("|") + 1;
         flag += para.indexOf("<") + 1;
         flag += para.indexOf(">") + 1;
        if (flag != 0)
        ...{
             System.out.println("提交了非法字符!!!");
            return false;
         }
        return true;
     }

////////////////////////////////////////////////////////////////////////////////

'过滤SQL非法字符并格式化html代码
function Replace_Text(fString)
if isnull(fString) then
Replace_Text=""
exit function
else
fString=trim(fString)
fString=replace(fString,"'","''")
fString=replace(fString,";","；")
fString=replace(fString,"--","—")
fString=server.htmlencode(fString)
Replace_Text=fString
end if
end function

function changechr(str)
changechr=replace(replace(replace(replace(str,"<","&lt;"),">","&gt;"),chr(13),"<br>")," ","&nbsp;")
changechr=replace(replace(replace(replace(changechr,"[sayyes]","<div align=center><img src="),"","<b>"),"[red]","<font color=CC0000>"),"[big]","<font size=7>")
changechr=replace(replace(replace(replace(changechr,"[/sayyes]","></img></div>"),"","</b>"),"[/red]","</font>"),"[/big]","</font>")
end function

 

'会员发布的各种信息过滤
'Function Replace_Text(fString)
'If Not IsNull(fString) Then
'fString = trim(fString)
'fString = replace(fString, ";", "；")     '分号过滤
'fString = replace(fString, "--", "——") '--过滤
'fString = replace(fString, "%20", "")    '特殊字符过滤
'fString = replace(fString, "==", "")     '==过滤
'fString = replace(fString, ">", "&gt;")
'fString = replace(fString, "<", "&lt;")
'fString = Replace(fString, CHR(32), " ")   '&nbsp;
'fString = Replace(fString, CHR(9), " ")    '&nbsp;
'fString = Replace(fString, CHR(34), "&quot;")
'fString = Replace(fString, CHR(39), "'") '单引号过滤
'fString = Replace(fString, CHR(13), "")
'fString = Replace(fString, CHR(10) & CHR(10), "</P><P> ")
'fString = Replace(fString, CHR(10), "<BR> ")
'Replace_Text = fString
'End If
'End Function

'过滤SQL非法字符
Function checkStr(Chkstr)
dim Str:Str=Chkstr
if isnull(Str) then
   checkStr = ""
   exit Function
else
   Str=replace(Str,"'","")
   Str=replace(Str,";","")
   Str=replace(Str,"--","")
   checkStr=Str
end if
End Function

'检测传递的参数是否为数字型
Function Chkrequest(Para)
Chkrequest=False
If Not (IsNull(Para) or Trim(Para)="" or Not IsNumeric(Para)) Then
    Chkrequest=True
End If
End Function

'检测传递的参数是否为日期型
Function Chkrequestdate(Para)
Chkrequestdate=False
If Not (IsNull(Para) or Trim(Para)="" or Not IsDate(Para)) Then
    Chkrequestdate=True
End If
End Function

'得到当前页面的地址
Function GetUrl()
On Error Resume Next
Dim strTemp
If LCase(Request.ServerVariables("HTTPS")) = "off" Then
strTemp = "http://"
Else
strTemp = "https://"
End If
strTemp = strTemp & CheckStr(Request.ServerVariables("SERVER_NAME"))
If Request.ServerVariables("SERVER_PORT") <> 80 Then strTemp = strTemp & ":" & CheckStr(Request.ServerVariables("SERVER_PORT"))
strTemp = strTemp & CheckStr(Request.ServerVariables("URL"))
If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & CheckStr(Trim(Request.QueryString))
GetUrl = strTemp
End Function

'Function CheckReferer()   '检查用户是否在浏览器里输入了本页的地址
'     Dim sReferer, Icheck
'     CheckReferer = True
'     sReferer = Request.ServerVariables("HTTP_REFERER")
'     ServerIP = Request.ServerVariables("LOCAL_ADDR")
'     Icheck = InStr(sReferer, "ServerIP")
'     If Icheck = 0 Then
'     CheckReferer = False
'     End If
'End Function

'日期格式化
Function FormatDate(DT,tp)
dim Y,M,D
Y=Year(DT)
M=month(DT)
D=Day(DT)
if M<10 then M="0"&M
if D<10 then D="0"&D
select case tp
case 1 FormatDate=Y&"年"&M&"月"&D&"日"
case 2 FormatDate=Y&"-"&M&"-"&D
end select
End Function