asp防止主入的代码

<%
StrTemp=request.servervariables("server_name")&request.servervariables("url")&"?"&Request.QueryString
StrTemp = LCase(StrTemp)
If Instr(StrTemp,"select%20") or Instr(StrTemp,"insert%20") or Instr(StrTemp,"delete%20from") or Instr(StrTemp,"count(") or Instr(StrTemp,"drop%20table") or Instr(StrTemp,"update%20") or Instr(StrTemp,"truncate%20") or Instr(StrTemp,"asc(") or Instr(StrTemp,"mid(") or Instr(StrTemp,"char(") or Instr(StrTemp,"xp_cmdshell") or Instr(StrTemp,"exec%20master") or Instr(StrTemp,"net%20localgroup%20administrators") or Instr(StrTemp,"net%20user") or Instr(StrTemp,"%20or%20") or Instr(StrTemp,"'") or Instr(StrTemp,"%20") or Instr(StrTemp,"""") or Instr(StrTemp,"“") or Instr(StrTemp,"”")  or Instr(StrTemp,":") or Instr(StrTemp,"：")  or Instr(StrTemp,";") or Instr(StrTemp,"；")  or Instr(StrTemp,",") or Instr(StrTemp,"，")  or Instr(StrTemp,"-") or Instr(StrTemp,"%27") then
Response.Write "<script language='javascript'>alert('非法操作！立即返回！');history.back();</script>"
Response.end
End If
%>

上面一般都放在conn.asp这个数据库连接文件里面，

以下收集一些：
<%
keyword=request.form("keyword")
if keyword="" then
Response.Redirect "admin_gallery.asp"
Response.Flush
else
keyword=replace(keyword,"""","")
keyword=replace(keyword,"exec","")
keyword=replace(keyword,"--","")
keyword=replace(keyword,";","")
keyword=replace(keyword,"declare","")
keyword=replace(keyword,"_","")
keyword=replace(keyword,"//","")
keyword=replace(keyword,"=","")
keyword=replace(keyword,"'","''")
keyword=replace(keyword,"@","")
keyword=replace(keyword,":","")
end if
%>