ASP安全写入数据库操作，正常读出并显示在不同的场合

<%Function fn_chk_to_sql_go(Str)
'如sql = "select * from "&request("table")的情况下.??
 If Isnull(Str) Then
  ChkSql = ""
  Exit Function
 End If
 Str = trim(Str)
 Str = Replace(Str, Chr(0), "",1,-1,1)
 Str = Replace(Str, """", "&quot;",1,-1,1)
 Str = Replace(Str, "'", "&#039;",1,-1,1)
 Str = Replace(Str, "<","&lt;",1,-1,1)
 Str = Replace(Str, ">","&gt;",1,-1,1)
 Str = Replace(Str, "[", "&#091;",1,-1,1)
 Str = Replace(Str, "]", "&#093;",1,-1,1)
 Str = Replace(Str, "\", "&#092;",1,-1,1)
 Str = Replace(Str, "*", "&#042;",1,-1,1)
 Str = Replace(Str, "%", "&#037;",1,-1,1)
 Str = Replace(Str, ";", "&#059;",1,-1,1)
 Str = Replace(Str, vbCrlf, "<br>",1,-1,1)
 Str = Replace(Str, "--", "&#045;&#045;")
 fn_chk_to_sql_go = Str
 End Function
%>

<%Function fn_chk_to_url(Str)

'如 str="<img src='showimg.asp?id="&request("id")&"'>"的情况下
 If Isnull(Str) Then
  ChkSql = ""
  Exit Function
 End If
 Str = trim(Str)
 Str = server.URLEncode(Str)
 fn_chk_to_sql_mark = Str
End Function
%>