<%
Function Get_SafeStr(str)
       dim BadStr,myarry
       str=lcase(str) 
       BadStr = "and|(|)|exec|insert|select|delete|update|count|chr|mid|master|truncate|char|declare|@|'|;|x|~|!|#|$|%|^|&|*|_|+|\|=|-|?|"&chr(34)&""
       myarry=split(BadStr,"|")
for i=0 to ubound(myarry)
  if instr(str,myarry(i))>0 then
        response.write "<script>alert('请不要在参数中包含非法字符尝试注入攻击本站,本站做起来很不容易的.俺是菜鸟,好怕怕,放俺一马吧！')</script>"
        response.write "<script>location.href='Default.asp'</script>"
        str=replace(str,myarry(i),"")
        Get_SafeStr=Get_SafeStr(str)
  else
        Get_SafeStr=str
  end if
next
end function

%>

------解决方案--------------------
VB code
function   Replace_Text(fString) 
if   isnull(fString)   then 
Replace_Text= " " 
exit   function 
else 
fString=trim(fString) 
fString=replace(fString, "'", "") 
fString=replace(fString, "; ", "； ") 
fString=replace(fString, "-", "") 
fString=replace(fString, "=", "")
fString=replace(fString, "and", " ") 
fString=replace(fString, "or", " ") 
fString=replace(fString, "select ", " ") 
fString=replace(fString, "insert ", " ") 
fString=replace(fString, "exec ", " ") 
fString=replace(fString, "delete ", " ") 
fString=replace(fString, "update ", " ") 
fString=replace(fString, "count ", " ") 
fString=replace(fString, "mid ", " ") 
fString=replace(fString, "truncate ", " ") 
fString=replace(fString, "% ", " ") 
fString=replace(fString, "master ", " ") 
fString=replace(fString, "char ", " ") 
fString=replace(fString, "declare ", " ") 
fString=replace(fString, "* ", " ") 
fString=replace(fString, "from ", " ") 
fString=server.htmlencode(fString) 
Replace_Text=fString 
end   if 
end   function