smt_inside.asp

来自「一个完全仿照阿里巴巴的网站管理系统 本软件没有版权问题」· ASP 代码 · 共 104 行

<%function SaveSqlLog(SMT_Log_type)
'SMT_type  日志属性   0为前台,1为后台,2为个人后台,3为企业后台
If Request.Form<>"" or Request.QueryString<>"" Then
select case SMT_Log_type
  case 0
    if session("useradmin")<>"" then SMT_Log_user=session("useradmin") else SMT_Log_user="客人"
  case 1
    if session("admin")<>"" then SMT_Log_user=session("admin") else SMT_Log_user="客人"
  case 2
    if session("individualuser")<>"" then SMT_Log_user=session("individualuser") else SMT_Log_user="客人"
  case 3
    if session("useradmin")<>"" then SMT_Log_user=session("useradmin") else SMT_Log_user="客人"
end select


If IsObject(LogConn) = false Then
set LogConn = Server.CreateObject("ADODB.Connection")
LogConn.Open SqlLogdata
If Err.Number <> 0 Then
   Response.write "系统日常维护中!"
   Response.End()
end if
end if

SMT_Log_type=int(SMT_Log_type)
SMT_Log_ScriptName=Request.ServerVariables("url")
if Request.Form <>"" then SMT_Log_Info=Request.Form else SMT_Log_Info=Request.QueryString
SMT_Log_IP=Request.ServerVariables("Remote_Addr")

set LogRs=Server.CreateObject("Adodb.Recordset")
LogSql="select * from SMT_log"
LogRs.open LogSql,LogConn,1,3
LogRs.addnew
LogRs("SMT_ScriptName")=SMT_Log_ScriptName
LogRs("SMT_Info")=SMT_Log_Info
LogRs("SMT_IP")=SMT_Log_IP
LogRs("SMT_Time")=now()
LogRs("SMT_type")=SMT_Log_type
LogRs("SMT_user")=SMT_Log_user
LogRs.update
LogRs.close
set LogRs=nothing
LogConn=close
set LogConn=nothing

end if
end function
'=======================================================防SQL注入
function SF_Sql
Fy_In = application("citysql")
'----------------------------------
Fy_Inf = split(Fy_In,"|")
'--------POST部份------------------
If Request.Form<>"" Then
For Each Fy_Post In Request.Form
For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh))<>0 Then
response.write"<script>alert('操作错误，下面是产生错误的可能原因：\n\n·在您提交的资料中含有敏感字符');history.go(-1);</script>"
response.end
End If
Next
Next
End If
'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString
For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
response.write"<script>alert('操作错误，下面是产生错误的可能原因：\n\n·在您提交的资料中含有敏感字符');history.go(-1);</script>"
response.end
End If
Next
Next
End If
end function
'=======================================================防SQL注入
function SF_PingSql
Fy_In = application("cityping")
'----------------------------------
Fy_Inf = split(Fy_In,"|")
'--------POST部份------------------
If Request.Form<>"" Then
For Each Fy_Post In Request.Form
For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh))<>0 Then
response.write"<script>alert('操作错误，下面是产生错误的可能原因：\n\n·在您提交的资料中含有敏感字符');history.go(-1);</script>"
response.end
End If
Next
Next
End If
'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString
For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
response.write"<script>alert('操作错误，下面是产生错误的可能原因：\n\n·在您提交的资料中含有敏感字符');history.go(-1);</script>"
response.end
End If
Next
Next
End If
end function
%>