1、sql安全检测函数
function checkstr(str,strtype)
dim strtmp
strtmp = ""
if strtype ="s" then
strtmp = replace(trim(str),"'","''")
strtmp = replace(strtmp,";","")
elseif strtype="i" then
if isnumeric(str)=false then str=false
strtmp = str
else
strtmp = str
end if
checkstr= strtmp
end function

把这函数放在你页面代码里，你的接收参数可以这样写
<%
yxzy=checkstr(request("yxzy"),"s")
%>

上面是指字符串型，如果你的参数是数字型，比方id
<%
id=request("id")
%>
那么安全的，你可以这么写：
yxzy=checkstr(request("yxzy"),"i")

2、过滤用户名中的非法字符
function dealusername(username_)
dim regexpobj
dim i,n
dim username,tempstr,resultstr

username=trim(username_)
set regexpobj=new regexp
regexpobj.global = true
regexpobj.pattern="^[a-za-z0-9_]+$" '只允许字母、数字和下划线
'regexpobj.pattern="^\w+$" '效果同上

resultstr=username
n=len(username)
for i=1 to n
tempstr=mid(username,i,1)
if not regexpobj.test(tempstr) then resultstr=replace(resultstr,tempstr,"")
next

set regexpobj=nothing
dealusername=resultstr
end function

3、防注入的安全request函数
function saferequest(paraname,paratype)
'--- 传入参数 ---
'paraname:参数名称-字符型
'paratype:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符)

dim paravalue
paravalue=request(paraname)
if paratype=1 then
if not isnumeric(paravalue) then
response.write "参数" & paraname & "必须为数字型！"
response.end
end if
else
paravalue=replace(paravalue,"'","''")
end if
saferequest=paravalue
end function

4、外部连接进入网站
<% dim refurl
refurl = request.servervariables("http_referer")
if refurl <> "" and instr(refurl,request.servervariables("server_name")) = 0 then
response.write("进入网站首页")
response.end()
end if %>
防止从外部连接进入网站，也可以防止被iframe

5、iis设置
sql注入入侵是根据iis给出的asp错误提示信息来入侵的，如果你把iis设置成不管出什么样的asp错误，只给出一种错误提示信息，即http 500错误，那么人家就没办法入侵了。具体设置请参看图2。主要把500:100这个错误的默认提示页面 c:\windows\help\iishelp\common\500-100.asp改成
c:\windows\help\iishelp\common\500.htm即可，这时，无论asp运行中出什么错，服务器都只提示http 500错误。

6、筛选掉不必要的sql语句
<%
'使用说明:在数据库连接页(如:conn.asp)或你要防注入的页头内包含此文件即可。<!--@include file="cf_sql.asp"-->(将@改为#)

dim cfsql_i,cfsql_sqlchr,cfsql_chrcontent
cfsql_sqlchr = "select*|and'|or'|insertinto|deletefrom|altertable|update|createtable|createview|dropview|createindex|dropindex|createprocedure|dropprocedure|createtrigger|droptrigger|createschema|dropschema|createdomain|alterdomain|dropdomain|);|select@|declare@|print@|char(|select"
cfsql_sqlchrs = split(cfsql_sqlchr,"|")

'======================================================
'post方式处理
'======================================================
if request.form<>"" then
for each cfsql_chrcontent in request.form
for cfsql_i=0 to ubound(cfsql_sqlchrs)
select case cfsql_sqlchrs(cfsql_i)
case "select"'为避免select的多表关联查询
if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"select")>0 and instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"from")>0 then
call cfsql_prompttitle()
end if
case "update"'update作额外处理,因update..set..
if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"update")>0 and instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),"set")>0 then
call cfsql_prompttitle()
end if
case else
if instr(lcase(replace(request.form(cfsql_chrcontent)," ","")),cfsql_sqlchrs(cfsql_i))>0 then
call cfsql_prompttitle()
end if
end select
next
next
end if

'======================================================
'get方式处理
'======================================================
if request.querystring<>"" then
for each cfsql_chrcontent in request.querystring
for cfsql_i=0 to ubound(cfsql_sqlchrs)
select case cfsql_sqlchrs(cfsql_i)
case "select"'为避免select的多表关联查询
if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"select")>0 and instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"from")>0 then
call cfsql_prompttitle()
end if
case "update"'update作额外处理,因update..set..
if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"update")>0 and instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),"set")>0 then
call cfsql_prompttitle()
end if
case else
if instr(lcase(replace(request.querystring(cfsql_chrcontent)," ","")),cfsql_sqlchrs(cfsql_i))>0 then
call cfsql_prompttitle()
end if
end select
next
next
end if

%>