asp 获取参数值与sql安全过滤参数函数代码

'获取参数值
function getform(element,ftype)
select case ftype
case "get"
getform=trim(request.querystring(element))
case "post"
getform=trim(request.form(element))
case "both"
if isnul(request.querystring(element)) then getform=trim(request.form(element)) else getform=trim(request.querystring(element))
end select
getform=replace(getform,chr(34),""")
getform=replace(getform,chr(39),"'")
end function
'主要功能就是获取参数值，比直接用request("element")要安全很多


'过滤参数
function filterpara(byval para)
filterpara=preventsqlin(checkxss(para))
end function

function preventsqlin(content)
dim sqlstr,sqlarray,i,spestr
sqlstr="<|>|%|%27|'|''|;|*|and|exec|dbcc|alter|drop|insert|select|update|delete|count|master|truncate|char|declare|where|set|declare|mid|chr"
if isnul(content) then exit function
sqlarray=split(sqlstr,"|")
for i=lbound(sqlarray) to ubound(sqlarray)
if instr(lcase(content),sqlarray(i))<>0 then
select case sqlarray(i)
case "<":spestr="<"
case ">":spestr=">"
case "'","""":spestr="""
'case ";":spestr="；"
case else:spestr=""
end select
content=replace(content,sqlarray(i),spestr,1,-1,1)
end if
next
preventsqlin=content
end function
'上面的参数过滤函主要是防止sql注入，加强的防护。