title: Sql injection script
body: <p>This title of the question may seem to be previously asked and answered but its different scenario for me. I use this script to stop sql injection in my ASP site. As per my knowledge or injecting script i have tried everything . Is it still possible to break through this code or do you feel this is fine . </p>
  
  <p>Here is the script</p>
  
  <pre><code>&lt;%
  Function IsInject(strCheck, boolForm)
      IsInject = False
      If Not boolForm And Len(strCheck) &gt; 50 Then IsInject = True
  '   Dim sCmdList, arrCmds, i
      If boolForm Then
          sCmdList = "declare,varchar,convert,delete,create,is_srvrolemember,ar(,cast("
      Else
          sCmdList = "update,union,select,drop,declare,varchar,convert,delete,create,is_srvrolemember,ar(,cast(,char("
      End If
      arrCmds = Split(sCmdList, ",")
      For i = 0 To UBound(arrCmds)
          If Instr(UCase(CStr(strCheck)), UCase(arrCmds(i))) &gt; 0 Then
              IsInject = True
              Exit For
          End If
      Next
      Erase arrCmds
  End Function
  Function CleanInject(strClean, boolInt)
      If boolInt Then CleanInject = CInt(strClean) Else CleanInject = Replace(strClean, "'", "''")
  End Function
  
  '-----------------------------------------------------------
  'redirect user if specific IP
  'Dim ipaddress, bFBIRedirect, sInjectType
  bFBIRedirect = True
  ipaddress = Request.ServerVariables("REMOTE_ADDR")
  Select Case ipaddress
      Case "90.120.206.10"
      Case Else
          bFBIRedirect = False
  End Select
  If bFBIRedirect Then Response.Redirect "http://www.fbi.gov"
  '-----------------------------------------------------------
  
  'Dim bIsInject, sHackString
  bIsInject = False
  
  If Not bInject Then
  '   Dim qsItm
      For Each qsItm In Request.QueryString
          If IsInject(Request.QueryString(qsItm), False) Then
              bIsInject = True
              sHackString = qsItm &amp; "=" &amp; Request.QueryString(qsItm)
              sHackType = "QueryString"
              sInjectType = "qs-" &amp; Request.QueryString(qsItm)
              Exit For
          End If
      Next
  End If
  If Not bInject Then
  '   Dim frmItm
  '   For Each frmItm In Request.Form
  '       If IsInject(Request.Form(frmItm), True) Then
  '           bIsInject = True
  '           sHackString = Request.Form(frmItm)
  '           sHackString = frmItm &amp; "=" &amp; Request.Form(frmItm)
  '           sHackType = "Form"
  '           Exit For
  '       End If
  '   Next
  End If
  
  If bIsInject Then
      Session("hacktype") = sHackType
      Session("hackstr") = sHackString
      Session("thepagefrom") = Request.ServerVariables("PATH_INFO")
      Session("theip") = Request.ServerVariables("REMOTE_ADDR")
  
  '   Dim arrWhereAt, iWhereAt, sRedirect
  
      arrWhereAt = Split(Request.ServerVariables("PATH_INFO"), "/")
      iWhereAt = UBound(arrWhereAt)
  
      sRedirect = "unknownerror.asp?ip=" &amp; Request.ServerVariables("REMOTE_ADDR") &amp; "&amp;err=" &amp; sInjectType &amp; "&amp;pg=" &amp; Request.ServerVariables("PATH_INFO")
      If iWhereAt = 1 Then sRedirect = "../" &amp; sRedirect
      If iWhereAt = 2 Then sRedirect = "../../" &amp; sRedirect
      If iWhereAt = 3 Then sRedirect = "../../../" &amp; sRedirect
  
      Response.Redirect sRedirect
  End If
  %&gt;
  </code></pre>