Removing illegal charachters

All the reading I’ve been doing tells me I have to make sure to remove any chance of ‘SQL insertion’ etc, into my forms, but can’t find a practical example of how this is done in JScript.

I’m trying to use the ‘replace’ method to remove charactercombinations like ‘<%' etc. sample code: var vName = Request.form("name"); vName.Replace(/<%/, ""); returns error - Error Type: Microsoft JScript runtime (0x800A138F) Object expect Where am I going wrong?