- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
<script>
var IllegalChars=new Array("select", "drop", ";", "--", "insert", "delete", "xp_", "update", "/", ":", "char(", "?", "`", "|", "declare", "convert", "cast(", "@@", "varchar", "2D2D", "4040", "00400040", "[", "]");
var IllegalFound=new Array();
var IllegalCharsCount=0;
function ResetCharsCount()
{
IllegalCharsCount=0;
}
function wordFilter(form,fields)
{
ResetCharsCount();
var CheckTextInput;
var fieldErrArr=new Array();
var fieldErrIndex=0;
for(var i=0; i<fields.length; i++)
{
CheckTextInput = document.forms[form].elements[fields[i]].value;
for(var j=0; j<IllegalChars.length; j++)
{
for(var k=0; k<(CheckTextInput.length); k++)
{
if(IllegalChars[j]==CheckTextInput.substring(k,(k+IllegalChars[j].length)).toLowerCase())
{
IllegalFound[IllegalCharsCount]=CheckTextInput.substring(k,(k+IllegalChars[j].length));
IllegalCharsCount++;
fieldErrArr[fieldErrIndex]=i;
fieldErrIndex++;
}
}
}
}
var alert_text="";
for(var k=1; k<=IllegalCharsCount; k++)
{
alert_text+="\n" + "(" + k + ") " + IllegalFound[k-1];
eval('CheckTextInput=document.' + form + '.' + fields[fieldErrArr[0]] + '.select();');
}
if(IllegalCharsCount>0)
{
alert("The form cannot be submitted.\nThe following errors were found:\n_______________________________\n" + alert_text + "\n_______________________________\n");
return false;
}
else
{
return true;
document.forms[form].submit();
}
}
</script>
...
<FORM NAME="FormHome" ACTION="search.asp" METHOD="post" onSubmit="return wordFilter('FormHome',['criteria']);">
Follow us!