devolve_art_submitsave.asp

都市星空BBS系统 v1.1(SQL)

<%
'==============================================================================
'软件名称：星空社区 VER 1.0.15
'当前版本：starcity club V1.0.15
'最新更新：2004.9
'==============================================================================
'Copyright (C) 2002-2004 Googln.com  All rights reserved.
'商业注册联系：010-64410364
'技术支持QQ：6370639(限商业用户) 
'程序开发：Googln Studio(BeiJing)
'Email:[e-mail]
'论坛支持：星空社区(http://www.starcity.cn/bbs)
'官方网站：www.Googln.com  演示站点：www.starcity.cn/bbs  都市星空：www.starcity.cn 阳光商城:www.sunmall.com.cn
'==============================================================================
'免费版本请在首页保留版权信息，并做上本站LOGO友情连接
'都市星空在线保留此程序的法律追究权利
'==============================================================================
%>
<!--#include file="include/conn.asp"-->
<!-- #include file="inc.asp" -->
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link rel="stylesheet" type="text/css" href="include/style_.css">
<%
if session("username")="" or isempty(session("username")) then
	show_error("您不是本站会员，或者登录超时，请重新登录")
end if

selectboard=trim(request("selectboard"))
bbsid=trim(request("bbsid"))
boardid=trim(request("boardid"))

'添加验证输入信息合法性 2004/05/11
	if instr(boardid,"'")<>0 or instr(boardid,"=")<>0 or instr(boardid,"&")<>0 or instr(boardid,"%")<>0 or instr(boardid,"or")<>0 then 
	    show_error("出现非法字符,对不起!") 
	end if
	if instr(bbsid,"'")<>0 or instr(bbsid,"=")<>0 or instr(bbsid,"&")<>0 or instr(bbsid,"%")<>0 or instr(bbsid,"or")<>0 then 
	    show_error("出现非法字符,对不起!") 
	end if

'检查文章及斑竹
set rs=server.createobject("adodb.recordset")
sqltext="select db_bbs.bbsid,db_bbs.boardid,db_bbs.author,db_bbs.rootid,db_board.boardid,db_board.boardmaster from db_bbs,db_board where db_bbs.bbsid="&bbsid&"and db_board.boardid="&boardid
rs.open sqltext,conn,1,1

if session("username")<>rs("boardmaster") then
	show_error("您没有修改此文章的权限!")
end if
rs.close

'转帖
sql="select * from db_bbs where bbsid="&bbsid&" or rootid="&bbsid
rs.open sql,conn,1,3
rs("boardid")=selectboard
rs.update
rs.close


sqltext="select boardname from db_board where boardid="&selectboard
rs.open sqltext,conn,1,1
%>
<script language=Javascript>
<!--
alert("转帖成功！");
window.location="main.asp?boardid=<%=Request("boardid")%>"
-->
</script>
<%
rs.close
%>