【ASP】過濾SQL及Javascript 關鍵字

<%

Function csstr(thetext)
ttext=thetext
BlackList = Array("'", "';", "/*", "*/", "@@","--",_
                             "char", "nchar", "varchar", "nvarchar",_ 
                             "alter", "begin", "cast", "create", "cursor",_
                             "declare", "delete", "drop", "end", "exec",_
                             "execute", "fetch", "insert", "kill", "open",_
                             "table", "update",  "\",  "&", "<script",_
                             "select", "sys", "sysobjects", "syscolumns")
 
 if len(ttext)>0 then
    For Each s in BlackList
         the_err_let=instr(lcase(ttext),s)
       do while the_err_let>0
           ltext=left(ttext,the_err_let-1)
           rlen=len(ttext)-the_err_let - len(s) + 1 
           rtext=right(ttext, rlen)
           ttext=ltext & rtext
           if len(ttext)>0 then
              the_err_let=instr(lcase(ttext),s)
           else
              the_err_let=0
           end if
       loop
    next 
 end if
csstr=ttext
End Function

'用意在於資料寫進資料庫前,將一些關鍵字過濾以防錯誤也比較安全之

 p_username=csstr(request("p_username"))    'EX : 登入帳號
 p_password=csstr(request("p_password"))     'EX : 登入密碼

%>