newsedit.asp

来自「易和阳光购物商城 v1.3 | 功能简介 增加了防注入文件」· ASP 代码 · 共 134 行

ASP
134
字号
<!--#include file="conn.asp"-->
<%if session("bjxadmin")="" then
response.Write "<script language='javascript'>alert('网络超时或您还没有登陆!');window.location.href='login.asp';</script>"
response.End
else
if session("flag")>1 then
response.Write "<p align=center><font color=red>您没有此项目管理权限!</font></p>"
response.End
end if
end if
dim newsid
newsid=request.QueryString("id")
if not isnumeric(newsid) then 
response.write"<script>alert(""非法访问!"");location.href=""../index.asp"";</script>"
response.end
end if
if request.QueryString("action")="save" then 

Content=Request.Form("bookcontent")

'将里面的链接换成本地链接
 aa="http://"&Request.ServerVariables("server_name")&Request.ServerVariables("path_info")
 aa= mid(aa,1,len(aa)-18)		'18=admin/newsedit.asp
content=replace(content,aa,"")

session("content")=content
 
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from BJX_news where newsid="&newsid,conn,1,3
rs("newsname")=trim(request("newsname"))
rs("addname")=trim(request("addname"))
rs("newscontent")=trim(request("content"))
rs("adddate")=now()
rs.update
rs.close
set rs=nothing
session("content")=""
response.write "<script language=javascript>alert('更改成功!');window.location.href='"&request("linkaddress")&"';</script>"
response.End
end if
%>
<html><head><title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<script language="javascript">
<!--
function checkdata()
{
if (document.form1.newsname.value=="")
	{
	  alert("对不起,请输入新闻主题!")
	  document.form1.newsname.focus()
	  return false
	 }
if (document.form1.viewhtml.checked == true)
	{
	  alert("对不起,请取消“查看HTML源代码”后再添加!")
	  document.form1.viewhtml.focus()
	  return false
	 }
if (document.form1.Content.value.length==0)
	{
	  alert("对不起,请输入文章内容!")
	  //document.form1.content.focus()
	  return false
	 }
}

function MM_goToURL() { //v3.0
  var i, args=MM_goToURL.arguments; document.MM_returnValue = false;
  for (i=0; i<(args.length-1); i+=2) eval(args[i]+".location='"+args[i+1]+"'");
}

function MM_openBrWindow(theURL,winName,features) { //v2.0
  window.open(theURL,winName,features);
}
//-->
</script>
<link href="../images/css.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--
.style1 {
	color: #FFFFFF;
	font-weight: bold;
}
-->
</style>
</head>
<body>
<%set rs=server.CreateObject("adodb.recordset")
rs.open "select * from BJX_news where newsid="&newsid,conn,1,1%>
<table class="tableBorder" width="90%" border="0" align="center" cellpadding="0" cellspacing="1" >
<tr> 
<td colspan="4" align="center" background="../images/admin_bg_1.gif"><span class="style1">更改网站新闻</span></td>
</tr>
<tr> 
<td valign="top"> 
<form name="form1" method="post" action="newsedit.asp?action=save&id=<%=newsid%>" OnSubmit="return checkdata()" onReset="return ResetForm();">
<table width="100%" border="0" align="center" cellpadding="3" cellspacing="1">
<tr > 
<td width="20%" align="right">新闻主题:</td>
<td style="PADDING-LEFT: 10px"> 
<input name="newsname" type="text" id="newsname" value=<%=trim(rs("newsname"))%>></td>
</tr>
<tr > 
<td align="right">发 表 人:</td>
<td style="PADDING-LEFT: 10px"> 
<input name="addname" type="text" id="addname" value=<%=trim(rs("addname"))%>>
</td>
</tr>
<tr > 
<td align="right" valign="top">新闻内容:</td>
<td style="PADDING-LEFT: 10px">
<%
dim bjxc,bjxi
bjxc	= rs("newscontent")
bjxi    = "bookcontent"
%><input type="hidden" id="myEditor" value="" style="display:none" /><textarea id="Content" name="Content" style="display:none"><div><%= bjxc %></div></textarea><iframe id="Content___Frame" src="Iheeo_editor/editor.htm?id=Content&ReadCookie=0" frameborder="0" scrolling="no" width="621" height="457"></iframe>
</td>
</tr>
<tr>
<td align="right" ></td> 
<td height="30"  style="PADDING-LEFT: 10px">
<input type="submit" name="Submit" value="修改保存">
<input type="button" value=" 返 回 " onClick="javascript:history.go(-1)" class="unnamed5" name="button">
<input type="hidden" name="linkaddress" value="<%=request.servervariables("http_referer")%>">
</td>
</tr>
</table>
</form>
</td>
</tr>
</table>
</body>
</html>

⌨️ 快捷键说明

复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?