edit_artsave.asp

都市星空BBS系统 v1.1(SQL)

<%
'==============================================================================
'软件名称：星空社区 VER 1.0.15
'当前版本：starcity club V1.0.15
'最新更新：2004.9
'==============================================================================
'Copyright (C) 2002-2004 Googln.com  All rights reserved.
'商业注册联系：010-64410364
'技术支持QQ：6370639(限商业用户) 
'程序开发：Googln Studio(BeiJing)
'Email:[e-mail]
'论坛支持：星空社区(http://www.starcity.cn/bbs)
'官方网站：www.Googln.com  演示站点：www.starcity.cn/bbs  都市星空：www.starcity.cn 阳光商城:www.sunmall.com.cn
'==============================================================================
'免费版本请在首页保留版权信息，并做上本站LOGO友情连接
'都市星空在线保留此程序的法律追究权利
'==============================================================================
%>
<!--#include file="include/conn.asp"-->
<!-- #include file="inc.asp" -->
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link rel="stylesheet" type="text/css" href="include/style_.css">
<%
if session("username")="" or isempty(session("username")) then
	show_error("您不是本站会员，或者登录超时，请重新登录")
end if

boardid=trim(request("boardid"))
bbsid=trim(request("bbsid"))
pic=trim(request("pic"))
title=trim(request("title"))
content=trim(request("content"))

'添加验证输入信息合法性 2004/05/11
		if instr(boardid,"'")<>0 or instr(boardid,"=")<>0 or instr(boardid,"&")<>0 or instr(boardid,"%")<>0 or instr(boardid,"or")<>0  then 
	   		 show_error("出现非法字符,对不起!") 
		end if
		if instr(bbsid,"'")<>0 or instr(bbsid,"=")<>0 or instr(bbsid,"&")<>0 or instr(bbsid,"%")<>0 or instr(bbsid,"or")<>0  then 
	   		 show_error("出现非法字符,对不起!") 
		end if
		if instr(title,"'")<>0 or instr(title,"=")<>0 or instr(title,"&")<>0 or instr(title,"%")<>0 then 
	   		 show_error("出现非法字符,对不起!") 
		end if
		if instr(content,"=")<>0 or instr(content,"&")<>0 or instr(content,"%")<>0  then 
	   		 show_error("出现非法字符,对不起!") 
		end if

if boardid="" or pic="" or title="" or content="" then
	show_error("请输入完全！")
end if

'检查文章及斑竹
set rs=server.createobject("adodb.recordset")
sqltext="select db_bbs.bbsid,db_bbs.boardid,db_bbs.author,db_bbs.rootid,db_board.boardid,db_board.boardmaster from db_bbs,db_board where db_bbs.bbsid="&bbsid&"and db_board.boardid="&boardid
rs.open sqltext,conn,1,1

if session("username")<>rs("boardmaster") and session("username")<>rs("author") then
	show_error("您没有修改此文章的权限!")
end if
rs.close

'新增回复
sql="select * from db_bbs where bbsid="&bbsid
rs.open sql,conn,1,3

rs("title")=title
rs("content")=content
rs("pic")=pic
rs.update
rs.close
%>
<script language=Javascript>
<!--
alert("帖子发表成功！");
window.location="main.asp?boardid=<%=Request("boardid")%>"
-->
</script>