'取得Request.Querystring 或 Request.Form 的值
 Public Function G(Str)
  G = Replace(Replace(Request(Str), "'", ""), """", "")
 End Function

看看，只过滤' 和 "，这样过滤完全不呢？

==================================================================

申明，本帖内容作废，我查到系统本身就有  函数名：ReplaceBadChar ，这个函数

==================================================================

G = Replace(Replace(Request(Str), "'", ""), """", "")

改为G = ReplaceBadChar(Replace(Replace(Request(Str), "'", ""), """", ""))更安全吧！

[此贴子已经被作者于2007-1-10 16:16:48编辑过]

" & Chr(34) & "," & Chr(0) & "

这个要去掉

动易新打的补丁里的函数借过来用。呵呵。

Function ReplaceBadChar(strChar)
    If strChar = "" Or IsNull(strChar) Then
        ReplaceBadChar = ""
        Exit Function
    End If
    Dim strBadChar, arrBadChar, tempChar, i
    strBadChar = "+,',--,%,^,&,?,(,),<,>,[,],{,},/,\,;,:"
    arrBadChar = Split(strBadChar, ",")
    tempChar = strChar
    For i = 0 To UBound(arrBadChar)
        tempChar = Replace(tempChar, arrBadChar(i), "")
    Next
    tempChar = Replace(tempChar, "@@", "@")
    ReplaceBadChar = tempChar
End Function

Function ReplaceUrlBadChar(strChar)
    If strChar = "" Or IsNull(strChar) Then
        ReplaceUrlBadChar = ""
        Exit Function
    End If
    Dim strBadChar, arrBadChar, tempChar, i
    strBadChar = "+,',--,(,),<,>,[,],{,},\,;"
    arrBadChar = Split(strBadChar, ",")
    tempChar = strChar
    For i = 0 To UBound(arrBadChar)
        tempChar = Replace(tempChar, arrBadChar(i), "")
    Next
    tempChar = Replace(tempChar, "@@", "@")
    ReplaceUrlBadChar = tempChar
End Function

[此贴子已经被作者于2007-1-9 17:09:45编辑过]

怎么用