ASP/VBScript 防 SQL 注入函數庫：數值驗證、字串過濾、長度截斷

經典 ASP (VBScript) 環境下，透過集中函數處理所有外部輸入 (Request.Form, QueryString, Cookies)，實作 SQL 注入防護與 XSS 過濾。

核心函數

1. CheckNum - 數值驗證與範圍限制

Function CheckNum(str_str, int_quest, int_startnum, int_endnum)
    Dim mystr, istr, iNum
    mystr = Trim(str_str)
    Select Case int_quest
        Case 1: istr = Request.Form(mystr)
        Case 2: istr = Request.QueryString(mystr)
        Case 3: istr = Request.Cookies(mystr)
        Case 4: istr = Request(mystr)
        Case Else: istr = mystr
    End Select
    istr = Left(istr, 32)  -- 限制長度防緩衝區溢位
    If IsNumeric(istr) Then
        iNum = CDbl(istr)
    Else
        iNum = int_startnum  -- 非數值回傳預設最小值
    End If
    If int_endnum > -1 Then
        If iNum < int_startnum Then iNum = int_startnum
        If iNum > int_endnum Then iNum = int_endnum
    End If
    CheckNum = iNum
End Function

用法：id = CheckNum("id", 2, 1, 999999) (從 QueryString 取 id，範圍 1-999999)。

2. CheckStr - 字串過濾與 HTML 編碼

Function CheckStr(str_str, int_quest, int_type, int_strlen)
    Dim mystr, istr
    mystr = str_str
    Select Case int_quest
        Case 1: istr = Request.Form(mystr)
        Case 2: istr = Request.QueryString(mystr)
        Case 3: istr = Request.Cookies(mystr)
        Case 4: istr = Request(mystr)
        Case Else: istr = mystr
    End Select
    istr = "" & Trim(istr)
    istr = Replace(istr, "'", "''")  -- SQL 單引號轉義 (核心防注入)

    Select Case int_type
        Case 1:  -- 保留換行轉 
, 空格轉  
            istr = Replace(istr, Chr(32), " ")
            istr = Replace(istr, Chr(9), " ")
            istr = Replace(istr, Chr(10) & Chr(10), "
")
            istr = Replace(istr, Chr(10), "
")
            istr = Replace(istr, Chr(13), "")
        Case 2:  -- 純文字，不處理 HTML
            istr = istr
        Case 3:  -- 標題過濾：編碼 < > " ' 空白
            istr = Replace(istr, Chr(32), " ")
            istr = Replace(istr, Chr(9), " ")
            istr = Replace(istr, Chr(13), "")
            istr = Replace(istr, "<", "<")
            istr = Replace(istr, ">", ">")
            istr = Replace(istr, Chr(34), """)
            istr = Replace(istr, " ", " ")
            istr = Replace(istr, Chr(39), "'")
        Case Else: -- 預設：完整 HTML 編碼 + 換行處理
            istr = Replace(istr, Chr(32), " ")
            istr = Replace(istr, Chr(9), " ")
            istr = Replace(istr, Chr(10) & Chr(10), "
")
            istr = Replace(istr, Chr(10), "
")
            istr = Replace(istr, Chr(13), "")
            istr = Replace(istr, "<", "<")
            istr = Replace(istr, ">", ">")
            istr = Replace(istr, Chr(34), """)
            istr = Replace(istr, " ", " ")
            istr = Replace(istr, Chr(39), "'")
    End Select
    istr = CutStr(istr, int_strlen, "")  -- 長度截斷
    CheckStr = istr
End Function

3. CutStr - 雙位元組感知長度截斷

Function CutStr(str_str, int_strlen, str_addtrr)
    Dim k, i, c
    k = 0
    For i = 1 To Len(str_str)
        c = Abs(Asc(Mid(str_str, i, 1)))
        If c > 255 Then k = k + 2 Else k = k + 1  -- 中文算 2 寬度
        If k >= int_strlen Then Exit For
    Next
    CutStr = Left(str_str, k) & str_addtrr
End Function

使用原則

1. 所有外部輸入**唯一**透過此函數取值，嚴禁直接 Request("xxx")。
2. 數值欄位**必須**用 CheckNum，字串欄位用 CheckStr。
3. Replace(istr, "'", "''") 是 SQL Server 單引號轉義核心，配合參數化查詢 (ADO Command 物件) 雙重防護。
4. 現代 ASP.NET 應改用 SqlParameter / Entity Framework 參數化，不再需要手工轉義。