ASP写入数据库的字符过滤？

UserName=request("UserName")UserName=replace(UserName,"<iframe","")UserName=replace(UserName,"<script ","")……最好写个过滤函数过滤定义的那些敏感内容。

<%

sql="select * from gg"

set rs=server.createobject("adodb.recordset")

rs.open sql,conn,1,3

rs.addnew

if Request.Form("reg_name") then

response.write "<script>alert('姓名不能为空,请重新输入。')history.back(-1)</script>"

end if

if Request.Form("msgbook_content") then

response.write "<script>alert('留言内容不能为空,请重新输入。')history.back(-1)</script>"

end if

if Request.Form("msgbook_face") then

response.write "<script>alert('表情不能为空,请重新输入。')history.back(-1)</script>"

end if

if Request.Form("select") then

response.write "<script>alert('不能为空,请重新输入。')history.back(-1)</script>"

end if

rs("nr")=Request.Form("reg_name")

rs("lynr")=Request.Form("msgbook_content")

rs("bq")=Request.Form("msgbook_face")

rs("lj")=Request.Form("select")

rs.update

rs.close

conn.close

response.write"<SCRIPT language=JavaScript>"

response.write"JavaScript:window.location.href='00.asp'</SCRIPT>"

%>

function deletehtml($str) {

$str = trim($str)

$str = preg_replace("</P>","1234a3211",$str)

$str = preg_replace("</p>","1234a3211",$str)

$str = preg_replace("<br/>","1234a3211",$str)

$str = preg_replace("/<(.[^>]*)>/","",$str)

$str = preg_replace("/([\r\n])[\s]+/","",$str)

$str = preg_replace("/-->/","",$str)

$str = preg_replace("/<!--.*/","",$str)

$str = preg_replace("/&(quot|#34)/","",$str)

$str = preg_replace("/&(amp|#38)/", "/&/",$str)

$str = preg_replace("/&(lt|#60)/", "/</",$str)

$str = preg_replace("/&(gt|#62)/", ">",$str)

$str = preg_replace("/&(nbsp|#160)/", "",$str)

$str = preg_replace("/&(iexcl|#161)/", "/\xa1/",$str)

$str = preg_replace("/&(cent|#162)/", "/\xa2/",$str)

$str = preg_replace("/&(pound|#163)/", "/\xa3/",$str)

$str = preg_replace("/&(copy|#169)/", "/\xa9/",$str)

$str = preg_replace("/(\d+)/", "",$str)

$str = preg_replace("/</", "",$str)

$str = preg_replace("/>/", "",$str)

$str = preg_replace("/\r\n/", "",$str)

$str = preg_replace("/1234a3211/", "/<br/>/",$str)

return $str

}

---