<%
'过滤参数
s_injdata = "exec|select|update|delete|insert|and|script"

'SQL_injdata = SQL_injdata & "%20| |'|set |xp_cmdshell|exec master|xp_dirtree|exec master|char |net localgroup administrators|net user| or |mid(|asc(|truncate |declare|exec|varchar|" 
'SQL_injdata = SQL_injdata & "'/*|exec/*|insert/*|select/*|update/*|delete/*|set/*|xp_cmdshell|exec master|xp_dirtree|exec master|char/*|net localgroup administrators/*|*/and/*|net user |*/or/*|mid(|asc(|truncate/*|declare|exec|varchar" 

If Request.QueryString<>"" Then 
	s_form=lcase(Request.QueryString)  '传入参数
	s_temps=split(s_injdata,"|")
	for s_mycount=0 to ubound(s_temps)
	if  Instr(s_form,s_temps(s_mycount)) > 0 then
		response.write "输入非法:"&s_temps(s_mycount)
		response.end
	end if
	next
End If 

If Request.Form<>"" Then 
	s_form=lcase(Request.Form)  '传入参数
	s_temps=split(s_injdata,"|")
	for s_mycount=0 to ubound(s_temps)
	if  Instr(s_form,s_temps(s_mycount)) > 0 then
		response.write "输入非法:"&s_temps(s_mycount)
		response.end
	end if
	next
End If 


If Request.Cookies<>"" Then 
	s_form=lcase(Request.Cookies)  '传入参数
	s_temps=split(s_injdata,"|")
	for s_mycount=0 to ubound(s_temps)
	if  Instr(s_form,s_temps(s_mycount)) > 0 then
		response.write "输入非法:"&s_temps(s_mycount)
		response.end
	end if
	next
End If 

%>