过滤SQL非法字符并格式化html代码

加上SQL注入过滤代码，以前我也遇到过，再上以后就再也没有被注入过了！
我的过滤代码如下：
'过滤SQL非法字符并格式化html代码

function Replace_Text(fString)
Dim sqlIn,sqlinstr
if isnull(fString) then
Replace_Text=""
exit function
Else
sqlIn = "and|and%20|exec|insert|select|delete|update|count|chr|mid|master|truncate|char|declare|or%20"
sqlinstr=Split(sqlIn,"|")
For m=0 To ubound(sqlinstr)
   If InStr(LCase(fString),sqlinstr(m))>0 Then
        fString=lcase(trim(fString))
   End If
Next

fString=replace(fString,"'","‘")
fString=replace(fString,";","；")
fString=replace(fString,"--","—")
fString=replace(fString,"and","")
fString=replace(fString,"exec","")
fString=replace(fString,"insert","")
fString=replace(fString,"select","")
fString=replace(fString,"delete","")
fString=replace(fString,"update","")
fString=replace(fString,"and","")
fString=replace(fString,"*","")
fString=replace(fString,"chr","")
fString=replace(fString,"mid","")
fString=replace(fString,"master","")
fString=replace(fString,"truncate","")
fString=replace(fString,"char","")
fString=replace(fString,"declare","")
fString=replace(fString,"create","")
fString=server.htmlencode(fString)
fString=replace(fString,"&lt;sup&gt;&lt;small&gt;","^{<small>")
fString=replace(fString,"&lt;/small&gt;&lt;/sup&gt;","</small>}")
fString=replace(fString,"&lt;sub&gt;&lt;small&gt;","_{<small>")
fString=replace(fString,"&lt;/small&gt;&lt;/sub&gt;","</small>}")
Replace_Text=fString
end if   
end function