see a general ASP anti-SQL injection attack program. Keep it.

first of all, we define that the request cannot contain the following characters:

 | and | exec | insert | select | delete | update | count | * |% | chr | mid | truncate | char | declare

each character is separated by "|", and then we judge the resulting Request.QueryString. The specific code is as follows:

 dim sql_injdataSQL_injdata = & quot;' | and | exec | insert | select | delete | update | count | * |% | chr | mid | master | truncate | char | declare"SQL_inj = split (SQL_Injdata," | & quot;)If Request.QueryString<>"" ThenFor Each SQL_Get In Request.QueryStringFor SQL_Data=0 To Ubound (SQL_inj)If instr (Request.QueryString (SQL_Get), Sql_Inj (Sql_DATA)) & gt;0 ThenResponse.Write & quot;