ASP SQL Injection & XSS Cross 방지 코드

Function Check_sql(str) 



Dim result_str
SQL_Val = str 
SQL_Val = Replace(SQL_Val, ";", " ")
SQL_Val = Replace(SQL_Val, "@variable", " ")
SQL_Val = Replace(SQL_Val, "@@variable", " ")
SQL_Val = Replace(SQL_Val, "+", " ")
SQL_Val = Replace(SQL_Val, "print", " ")
SQL_Val = Replace(SQL_Val, "set", " ")
SQL_Val = Replace(SQL_Val, "%", " ")
SQL_Val = Replace(SQL_Val, "<script>", " ")
SQL_Val = Replace(SQL_Val, "<SCRIPT>", " ")
SQL_Val = Replace(SQL_Val, "script", " ")
SQL_Val = Replace(SQL_Val, "SCRIPT", " ")
SQL_Val = Replace(SQL_Val, "or", " ")
SQL_Val = Replace(SQL_Val, "union", " ")
SQL_Val = Replace(SQL_Val, "and", " ")
SQL_Val = Replace(SQL_Val, "insert", " ")
SQL_Val = Replace(SQL_Val, "openrowset", " ")
SQL_Val = Replace(SQL_Val, "xp_", " ")
SQL_Val = Replace(SQL_Val, "decare", " ")
SQL_Val = Replace(SQL_Val, "select", " ")
SQL_Val = Replace(SQL_Val, "update", " ")
SQL_Val = Replace(SQL_Val, "delete", " ")
SQL_Val = Replace(SQL_Val, "shutdown", " ")
SQL_Val = Replace(SQL_Val, "drop", " ")
SQL_Val = Replace(SQL_Val, "--", " ")
SQL_Val = Replace(SQL_Val, "/*", " ")
SQL_Val = Replace(SQL_Val, "*/", " ")
SQL_Val = Replace(SQL_Val, "XP_", " ")
SQL_Val = Replace(SQL_Val, "DECLARE", " ")
SQL_Val = Replace(SQL_Val, "SELECT", " ")
SQL_Val = Replace(SQL_Val, "UPDATE", " ")
SQL_Val = Replace(SQL_Val, "DELETE", " ")
SQL_Val = Replace(SQL_Val, "INSERT", " ")
SQL_Val = Replace(SQL_Val, "SHUTDOWN", " ")
SQL_Val = Replace(SQL_Val, "DROP", " ")



result_str = removeXSS(SQL_Val)
Check_sql = result_str 
End Function
Function removeXSS(get_String) 
get_String = Replace(get_String, "&", "&amp;") 
get_String = Replace(get_String, "<xmp", "<x-xmo", 1, -1, 1) 
get_String = Replace(get_String, "javascript", "<x-javascript", 1, -1, 1) 
get_String = Replace(get_String, "script", "<x-script", 1, -1, 1) 
get_String = Replace(get_String, "iframe", "<x-iframe", 1, -1, 1) 
get_String = Replace(get_String, "document", "<x-document", 1, -1, 1) 
get_String = Replace(get_String, "vbscript", "<x-vbscript", 1, -1, 1) 
get_String = Replace(get_String, "applet", "<x-applet", 1, -1, 1) 
get_String = Replace(get_String, "embed", "<x-embed", 1, -1, 1) 
get_String = Replace(get_String, "object", "<x-object", 1, -1, 1) 
get_String = Replace(get_String, "frame", "<x-frame", 1, -1, 1) 
get_String = Replace(get_String, "grameset", "<x-grameset", 1, -1, 1) 
get_String = Replace(get_String, "layer", "<x-layer", 1, -1, 1) 
get_String = Replace(get_String, "bgsound", "<x-bgsound", 1, -1, 1) 
get_String = Replace(get_String, "alert", "<x-alert", 1, -1, 1) 
get_String = Replace(get_String, "onblur", "<x-onblur", 1, -1, 1) 
get_String = Replace(get_String, "onchange", "<x-onchange", 1, -1, 1) 
get_String = Replace(get_String, "onclick", "<x-onclick", 1, -1, 1) 
get_String = Replace(get_String, "ondblclick","<x-ondblclick", 1, -1, 1) 
get_String = Replace(get_String, "enerror", "<x-enerror", 1, -1, 1) 
get_String = Replace(get_String, "onfocus", "<x-onfocus", 1, -1, 1) 
get_String = Replace(get_String, "onload", "<x-onload", 1, -1, 1) 
get_String = Replace(get_String, "onmouse", "<x-onmouse", 1, -1, 1) 
get_String = Replace(get_String, "onscroll", "<x-onscroll", 1, -1, 1) 
get_String = Replace(get_String, "onsubmit", "<x-onsubmit", 1, -1, 1) 
get_String = Replace(get_String, "onunload", "<x-onunload", 1, -1, 1) 
get_String = Replace(get_String, "<", "&lt;")
get_String = Replace(get_String, ">", "&gt;")
removeXSS = get_String



End Function