nosqlin.asp

这是一个ASP+VBScript+Access开发的网上家园源程序

<%
On Error Resume Next
Dim strTempUrl

If LCase(Request.ServerVariables("HTTPS")) = "off" Then
 strTempUrl = "http://"
Else
 strTempUrl= "https://"
End If

strTempUrl= strTemp & Request.ServerVariables("SERVER_NAME")
If Request.ServerVariables("SERVER_PORT") <> 80 Then strTempUrl= strTempUrl& ":" & Request.ServerVariables("SERVER_PORT")

strTempUrl = strTempUrl & Request.ServerVariables("URL")

If Trim(Request.QueryString) <> "" Then strTempUrl = strTempUrl & "?" & Trim(Request.QueryString)

strTempUrl = LCase(strTempUrl)

If Instr(strTempUrl,"select%20") or Instr(strTempUrl,"insert%20") or Instr(strTempUrl,"delete%20from") or Instr(strTempUrl,"count(") or Instr(strTempUrl,"drop%20table") or Instr(strTempUrl,"update%20") or Instr(strTempUrl,"truncate%20") or Instr(strTempUrl,"asc(") or Instr(strTempUrl,"mid(") or Instr(strTempUrl,"char(") or Instr(strTempUrl,"xp_cmdshell") or Instr(strTempUrl,"exec%20master") or Instr(strTempUrl,"net%20localgroup%20administrators")  or Instr(strTempUrl,"net%20user") or Instr(strTempUrl,"'") or Instr(strTempUrl,"%20or%20") then

Response.Write "参数非法！"
response.end
End If
%>