NB叶子的一些防SQL函数=====(转载）

最近休息，没事情看了几个黑客网站上的内容（都是因为我的网站最近已经被些无聊人士搞过两三次，而且每次的手段都不同，也看得出各自水平都不一样。前段时间比较忙，没多少时间来这里。现在闲下来，今天发现这个东西，贴出来给大家做个参考，函数本身是很简单，主要是看它的思路怎么样？）

NB叶子的一些防SQL函数

程序代码：

函数部分'用途:检查是否为数字,以及数字是否超出范围
'输入:检查字符,传值方式(0直接传,1取Form,2取QueryString,3取cookies,4直接Reqeust),开始数字(默认数字),结束数字(为-1则不检查大小)
FunctionCheckNum(str_str,int_quest,int_startnum,int_endnum)
mystr=Trim(str_str)
SelectCaseint_quest
Case1
istr=Request.Form(mystr)
Case2
istr=Request.QueryString(mystr)
Case3
istr=Request.Cookies(mystr)
Case4
istr=Request(mystr)
CaseElse
istr=mystr
EndSelect
istr=Left(istr,32)
IfIsNumeric(istr)Then
iNum=CDbl(istr)
Else
iNum=int_startnum
EndIf
Ifint_endnum>-1Then
IfiNum<int_startnumTheniNum=int_startnum
IfiNum>int_endnumTheniNum=int_endnum
EndIf
CheckNum=iNum
EndFunction
'------------------------------------------------
'用途:检查过滤字符串
'输入:字符串,传值方式(0直接传,1取Form,2取QueryString,3取cookies,4直接Reqeust),检查方式(1不过滤html,2纯html,3标题过滤,4其他html过滤,),字符段截取长度
FunctionCheckStr(str_str,int_quest,int_type,int_strlen)
mystr=str_str
SelectCaseint_quest
Case1
istr=Request.Form(mystr)
Case2
istr=Request.QueryString(mystr)
Case3
istr=Request.Cookies(mystr)
Case4
istr=Request(mystr)
CaseElse
istr=mystr
EndSelect
istr=""&Trim(istr)
istr=Replace(istr,"'","''")
SelectCaseint_type
Case1
istr=Replace(istr,CHR(32),"&nbsp;")
istr=Replace(istr,CHR(9),"&nbsp;")
istr=Replace(istr,CHR(10)&CHR(10),"</P><P>")
istr=Replace(istr,CHR(10),"<BR>")
istr=Replace(istr,CHR(13),"")
Case2
istr=istr
Case3
istr=Replace(istr,CHR(32),"&nbsp;")
istr=Replace(istr,CHR(9),"&nbsp;")
istr=Replace(istr,CHR(13),"")
istr=Replace(istr,"<","&lt;")
istr=Replace(istr,">","&gt;")
istr=Replace(istr,CHR(34),"&quot;")
istr=Replace(istr,"","&nbsp;")
istr=Replace(istr,CHR(39),"&#39;")
CaseElse
istr=Replace(istr,CHR(32),"&nbsp;")
istr=Replace(istr,CHR(9),"&nbsp;")
istr=Replace(istr,CHR(10)&CHR(10),"</P><P>")
istr=Replace(istr,CHR(10),"<BR>")
istr=Replace(istr,CHR(13),"")
istr=Replace(istr,"<","&lt;")
istr=Replace(istr,">","&gt;")
istr=Replace(istr,CHR(34),"&quot;")
istr=Replace(istr,"","&nbsp;")
istr=Replace(istr,CHR(39),"&#39;")
Endselect
istr=CutStr(istr,int_strlen,"")
CheckStr=istr
EndFunction
'------------------------------------------------
'用途:截取字符串
'输入:字符串,字符段截取长度,超过部分字符
FunctionCutStr(str_str,int_strlen,str_addtrr)
Dimk,i
k=0
Fori=1toLen(str_str)
c=Abs(Asc(Mid(str_str,i,1)))
Ifc>255Then
k=k+2
Else
k=k+1
EndIf
Ifk>=int_strlenThenExitFor
Next
CutStr=Left(str_str,k)&str_addtrr
EndFunction