confirm.asp

这是一个物流网站的源代码

<!--#include file="../inc/CheckAdmin.asp"-->
<!--#include file="../inc/Config.asp"-->
<!--#include file="../inc/Conn.asp"-->
<%    
dim url,sql,id,flag
id=request.QueryString("id")
url=request.ServerVariables("HTTP_REFERER")
flag=request.QueryString("flag")
If id="" or not isnumeric(id) then Check_Alert "非法操作",url
If flag="" or not isnumeric(flag) then Check_Alert "非法操作",url

if flag=0 then
   if instr(url,"Member") then
      sql="update Members set Flag=1 where ID="&id
   elseif instr(url,"Gbook") then
      sql="update ebook set E_Flag=1 where E_ID="&id
   elseif instr(url,"Order") then
      sql="update basket set AdminChecked=1 where ID="&id
   end if   
elseif  flag=1 then 
   if instr(url,"Member") then
      sql="update Members set Flag=0 where ID="&id
   elseif instr(url,"Gbook") then
      sql="update ebook set E_Flag=0 where E_ID="&id
   elseif instr(url,"Order") then
      sql="update basket set AdminChecked=0 where ID="&id	  
   end if    
end if   
conn.execute(sql)
response.Redirect(request.ServerVariables("HTTP_REFERER"))
%>