如何防御SQL注入攻击 网站安全狗来帮忙

写个函数
function htmlencode(fString)
if not isnull(fString) then
fString = replace(fString, ">", ">")
fString = replace(fString, "<", "<")
fString = Replace(fString, CHR(9), " ")
fString = Replace(fString, CHR(34), """)
fString = Replace(fString, CHR(39), "'")
fString = Replace(fString, CHR(10) & CHR(10), "</P>

")
fString = Replace(fString, Chr(13)&Chr(10), "
")
HTMLEncode = fString
end if
end function
调用即可。如：
username=htmlencode(request.form("username"))