conn.asp

这是一个非常好的留言版程序

<!--#include file="sqlin.asp"-->
<%

On Error Resume Next
Dim strTemp,hk
If Trim(Request.QueryString) <> "" Then strTemp =Trim(Request.QueryString)

strTemp = LCase(strTemp)
hk=0
If Instr(strTemp,"%")<>0 then hk=1
If Instr(strTemp,"%81")<>0 then hk=1
If Instr(strTemp,"htw(")<>0 then hk=1
If Instr(strTemp,"count(")<>0 then hk=1
If Instr(strTemp,"htr(")<>0 then hk=1
If Instr(strTemp,"asc(")<>0 then hk=1
If Instr(strTemp,"mid(")<>0 then hk=1
If Instr(strTemp,"and(")<>0 then hk=1
If Instr(strTemp,"or(")<>0 then hk=1
If Instr(strTemp,"char(")<>0 then hk=1
If Instr(strTemp,"xp_cmdshell")<>0 then hk=1
If Instr(strTemp,"'")<>0 then hk=1
if hk=1 then
Response.Write "对不起，您请求的数据不存在，请返回！！"
response.end
hk=0
End If

dim conn,connstr,db
db="#kdjazhdai/#ajjfas131#@#.asp"
Set conn=Server.CreateObject("ADODB.Connection")
connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(db)
conn.Open connstr
Function CloseDatabase
  Conn.close
  Set conn=Nothing
End Function
dim UserID
UserID=Request.Cookies("1zhaiID")
%>