SQL Injection 점검함수

Function fnCheckSQLInjection()
 Dim item, i, udata
 Dim retFlag

 retFlag = True

 For Each item In Request.QueryString
  For i = 1 To Request.QueryString(item).Count
   udata = LCase(Request.QueryString(item)(i) & "")
   If InStr(udata, "=cast(") > 0 Or InStr(udata, "sysdatabases") > 0 Or InStr(udata, "sysobjects") > 0 Or InStr(udata, "syscolumns") > 0 Or InStr(udata, "select char(94)") > 0 Then
    retFlag = False
    Exit For
   End If
  Next
  If retFlag = False Then
   Exit For
  End If
 Next

 If retFlag = True Then
  For Each item In Request.Form
   For i = 1 To Request.Form(item).Count
    udata = LCase(Request.Form(item)(i) & "")
   If InStr(udata, "=cast(") > 0 Or InStr(udata, "sysdatabases") > 0 Or InStr(udata, "sysobjects") > 0 Or InStr(udata, "syscolumns") > 0 Or InStr(udata, "select char(94)") > 0 Then
     retFlag = False
     Exit For
    End If
   Next
   If retFlag = False Then
    Exit For
   End If
  Next
 End If

 fnCheckSQLInjection = retFlag
End Function

'함수값이 False 면 팅군다.
If fnCheckSQLInjection() = False Then
….
end if
True 면 정상