database|set|char|asc|cast|declare|<script|script|iframe|3bomb|c.js|;";
//定义防注入的字符
   $arr=explode("|",$refuse_str);
//将$refuse_str中的值单独取出
   for($i=0;$i<count($arr);$i++)
   {
     $replace="[".$arr[$i]."]";
     $str=str_replace($arr[$i],$replace,$str);
//在变量$str中搜索字符串$arr[$i]，并将其替换为字符串[$replace]
   }
   return $str;
}
foreach ($_GET as $key=>$value)
//遍历获GET方法获得的参数$_GET的值传给$key,并赋值给$value
{
  $_GET[$key]=dowith_sql($value);
//将$value中的特征码处理传个$_GET[$key]
}
foreach ($_POST as $key=>$value)
{
  $_POST[$key]=dowith_sql($value);
}
?>

<?php
if($_COOKIE['id']!=null) {
//判断cookies不为空
foreach ($_COOKIE['id'] as $key=>$id){
//读取cookies中的值
if (if_numeric($id)<0){
echo "<script language=\\"javascript\\">alert(\\"请不要输入非法字符！\\");</script>" history.go(-1);</script>"; 
}
}
?>

<%
Dim xf_Post,xf_Get,xf_In,xf_Inf,xf_Xh,xf_db,xf_dbstr
'自定义需要过滤的字串,用 "|" 分隔
xf_In = "'|;|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
xf_Inf = split(xf_In,"|")
If Request.Form<>"" Then
For Each xf_Post In Request.Form

For xf_Xh=0 To Ubound(xf_Inf)
If Instr(LCase(Request.Form(xf_Post)),xf_Inf(xf_Xh))<>0 Then
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入');</Script>"
Response.Write "非法操作！系统做了如下记录↓<br>"
Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：ＰＯＳＴ<br>"
Response.Write "提交参数："&xf_Post&"<br>"
Response.Write "提交数据："&Request.Form(xf_Post)
Response.End
End If
Next
Next
End If
If Request.QueryString<>"" Then
For Each xf_Get In Request.QueryString
For xf_Xh=0 To Ubound(xf_Inf)
If Instr(LCase(Request.QueryString(xf_Get)),xf_Inf(xf_Xh))<>0 Then
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入');</Script>"
Response.Write "非法操作！系统已经给你做了如下记录↓<br>"
Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"

Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：ＧＥＴ<br>"
Response.Write "提交参数："&xf_Get&"<br>"
Response.Write "提交数据："&Request.QueryString(xf_Get)
Response.End
End If
Next
Next
End If
%>