Categoría: ASP

<%
Dim BlackList, ErrorPage, s

BlackList = Array("--", ";", "/*", "*/", "@@", "@",_
"char", "nchar", "varchar", "nvarchar",_
"alter", "begin", "cast", "create", "cursor",_
"declare", "delete", "drop", "end", "exec",_
"execute", "fetch", "insert", "kill", "open",_
"select", "sys", "sysobjects", "syscolumns",_
"table", "update")

' Populate the error page you want to redirect to in case the check fails.
ErrorPage = "/ErrorPage.asp"

' This function does not check for encoded characters since we do not know the form of encoding your application uses. Add the appropriate logic to deal with encoded characters in here
'''''''''''''''''''''''''''''''''''''''''''''''''''
Function CheckStringForSQL(str)
On Error Resume Next

Dim lstr

' If the string is empty, return true
If ( IsEmpty(str) ) Then
CheckStringForSQL = false
Exit Function
ElseIf ( StrComp(str, "") = 0 ) Then
CheckStringForSQL = false
Exit Function
End If

lstr = LCase(str)

' Check if the string contains any patterns in our black list
For Each s in BlackList

If ( InStr (lstr, s) <> 0 ) Then
CheckStringForSQL = true
Exit Function
End If

Next

CheckStringForSQL = false

End Function

' Check forms data
For Each s in Request.Form
If ( CheckStringForSQL(Request.Form(s)) ) Then

' Redirect to an error page
Response.Redirect(ErrorPage)

End If
Next

' Check query string
For Each s in Request.QueryString
If ( CheckStringForSQL(Request.QueryString(s)) ) Then

' Redirect to error page
Response.Redirect(ErrorPage)

End If

Next

' Check cookies
For Each s in Request.Cookies
If ( CheckStringForSQL(Request.Cookies(s)) ) Then
' Redirect to error page
Response.Redirect(ErrorPage)
End If
Next
%>

function convertirURLfriendly(cadena)
    if not isNull(cadena) then
    ' Eliminamos los espacios a ambos lados de la cadena
        strCadena = Trim(lCase(cadena))
        ' Reemplazamos carácteres especiales
        strCadena = replace(replace(strCadena,"'",""),"""","")
        strCadena = replace(replace(strCadena,""",""),vbcrlf,"")
        strCadena = replace(replace(strCadena,"<br>","")," ","-")
        set expReg = New RegExp
        ' Todas las ocurrencias
        expReg.Global = True
        expReg.Pattern = "[àáâãäå]"
        strCadena = expReg.Replace(strCadena, "a")
        expReg.Pattern = "[èéêë]"
        strCadena = expReg.Replace(strCadena, "e")
        expReg.Pattern = "[ìíîï]"
        strCadena = expReg.Replace(strCadena, "i")
        expReg.Pattern = "[òóôõö]"
        strCadena = expReg.Replace(strCadena, "o")
        expReg.Pattern = "[ùúûü]"
        strCadena = expReg.Replace(strCadena, "u")
        expReg.Pattern = "[ñ]"
        strCadena = expReg.Replace(strCadena, "n")
        expReg.Pattern = "[ç]"
        strCadena = expReg.Replace(strCadena, "c")
        ' Todo lo que no cumpla este patron
        expReg.Pattern = "[^a-z0-9-]"
        strCadena = expReg.Replace(strCadena, "")
        set expReg = nothing
        convertirAURLfriendly = left(strCadena,256)
    else
        convertirAURLfriendly = ""
    end if
end function

Response.Expires = -1
Response.AddHeader "Cache-Control", "no-cache"
Response.AddHeader "Cache-Control", "private"
Response.AddHeader "Cache-Control", "no-store"
Response.AddHeader "Cache-Control", "must-revalidate"
Response.AddHeader "Cache-Control", "max-stale=0"
Response.AddHeader "Cache-Control", "post-check=0"
Response.AddHeader "Cache-Control", "pre-check=0"
Response.AddHeader "Pragma", "no-cache"
Response.AddHeader "Keep-Alive", "timeout=3, max=993"
Response.AddHeader "Expires", "Thu, 10 Ene 2012 05:00:00 GMT"