一：处理SQL注入的
Function SafeReplace(ParaName)
'--- 传入参数 ---
'ParaName:参数名称-字符型，惊梦 84881411 2004/09/13
Dim Paravalue
Paravalue=LCase(Trim(ParaName))
Paravalue=Replace(Paravalue,"select","")
Paravalue=Replace(Paravalue,"insert","")
Paravalue=Replace(Paravalue,"updata","")
Paravalue=Replace(Paravalue,"addnew","")
Paravalue=Replace(Paravalue,"delete","")
Paravalue=Replace(Paravalue,"order","")
Paravalue=Replace(Paravalue,"and","")
Paravalue=Replace(Paravalue,"or","")
Paravalue=Replace(Paravalue,"exec","")
Paravalue=Replace(Paravalue,"--","")
Paravalue=Replace(Paravalue,"-","")
Paravalue=Replace(Paravalue,";","")
Paravalue=Replace(Paravalue,"%","")
Paravalue=Replace(Paravalue,"<","")
Paravalue=Replace(Paravalue,">","")
Paravalue=Replace(Paravalue,"(","")
Paravalue=Replace(Paravalue,")","")
Paravalue=Replace(Paravalue,"window.open","")
Paravalue=Replace(Paravalue,"window.close","")
Paravalue=Replace(Paravalue,"while(1)","")
Paravalue=Replace(Paravalue,"script","")
Paravalue=Replace(Paravalue,"'","")
Paravalue=Replace(Paravalue,chr(34),"")
Paravalue=Replace(Paravalue,chr(39),"")
SafeReplace=Paravalue
End function
Function SafeRequest(ParaName,ParaType)
'--- 传入参数 ---
'ParaName:参数名称-字符型
'ParaType:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符)
Dim Paravalue
Paravalue=Request(ParaName)
If ParaType=1 then
'添加非空判断 Paravalue=replace(Paravalue,"-","")
If Paravalue="" then
'Response.write "参数" & ParaName & "不能为空！"
Response.Write("<script language='javascript1.2'>history.go(-1)</script>")
Response.end
elseIf not isNumeric(Paravalue) then
'Response.write "参数" & ParaName & "必须为数字型！"
Response.Write("<script language='javascript1.2'>history.go(-1)</script>")
Response.end
End if
Else
Paravalue=replace(Paravalue,"'","''")
End if
SafeRequest=Paravalue
End function
二：反处理htmlencode的
Function HTMLDecode(strEncode)
strEncode=LCase(strEncode)
strEncode=Replace(strEncode,"&","&")
strEncode=Replace(strEncode,"<","<")
strEncode=Replace(strEncode,">",">")
strEncode=Replace(strEncode,""",Chr(34))
strEncode=Replace(strEncode,"<br>","\r\n")
strEncode=Replace(strEncode," "," ")
HTMLDecode = strEncode
End Function
三：去掉html标签
function nohtml(str)
dim re
Set re=new RegExp
re.IgnoreCase =true
re.Global=True
re.Pattern="(\<.[^\<]*\>)"
str=re.replace(str," ")
re.Pattern="(\<\/[^\<]*\>)"
str=re.replace(str," ")
nohtml=str
set re=nothing
end function
