哪位老大能提供一个你测试过的能真正防止注入攻击的代码呀！？谢谢拉

偶一般用 Replace(str ,"'","")  

数值 用 Isnumeric()

字串 用 Server.HTMLEncode()

function ck(str)
str=server.HTMLEncode(str)
str=replace(str,"'","‘")
str=replace(str,chr(39),"’")
str=replace(str,",","，")
str=trim(str)
str=replace(str,vbcrlf,"<br>")
str=replace(str,chr(13),"<br>")
ck=str
end function
用法
username=ck(request.form("username"))