放在conn.asp里就行了。

'屏蔽通过地址栏攻击

url=Request.ServerVariables("QUERY_STRING")

ifinstr(url,";")>=1then

url=Replace(url,";","；"):Response.Redirect("?"&url)

endif

'屏蔽通过表单攻击

foreachiteminrequest.form

stritem=lcase(server.HTMLEncode(Request.form(item)))

ifinstr(stritem,"select")>=1orinstr(stritem,"insert")>=1orinstr(stritem,"update")>=1orinstr(stritem,"delete")>=1orinstr(stritem,"exec")>=1orinstr(stritem,"declare")>=1then

response.write("对不起,请不要输入非法字符!")

response.end

endif

next