SQL防注入

'替换登陆名中的单引号和双引号

Dim UserID, UserPWD As String
UserID = txtUid.Text
UserPWD = txtPwd.Text
UserID = Replace(UserID, Chr(39), "'")
UserID = Replace(UserID, Chr(34), """)
UserPWD = Replace(UserPWD, Chr(39), "'")
UserPWD = Replace(UserPWD, Chr(34), """)

 

 

 

  ' NB联盟防注入函数 ReqNum / ReqStr

    '---------------------------------------------------------------

    Function ReqNum ( StrName )

    ReqNum = Request ( StrName )

    if Not isNumeric ( ReqNum ) then

    Response.Write "参数必须为数字型!"

    Response.End

    End if

    End Function

    Function ReqStr ( StrName )

    ReqStr = Replace ( Request(StrName), "'", "''" )

    End Function

    

    以上面三句SQL语句，说明一下调用方法：

1.SQL="Select * from Users where UserID=" & ReqNum("ID")

    2.SQL="Select * from Users where UserID='" & ReqStr("ID") & "'"

    3.SQL="Select * from Users where UserName like '%" & ReqStr("Name") & "%'"

    重申一点：上面的方法无论对SQLServer库还是Access或是其它数据库，都是绝对适用、绝对安全，但注意一点，SQLServer的存储过程是个例外，该情况下要把单引号替换成四个单引号，以保安全。

来源：https://www.cnblogs.com/709481260qq/p/4993438.html