saveaddgood.asp

易和阳光购物商城 v1.3 | 功能简介 增加了防注入文件

<!--#include file="conn.asp"-->
<%
if request("bookname")="" or request("shichangjia")="" or request("huiyuanjia")="" or request("vipjia")="" then
response.Write "对不起，添加失败，请用正确的方式添加商品！"
response.End
end if
function HTMLEncode2(fString)
	fString = Replace(fString, CHR(13), "")
	fString = Replace(fString, CHR(10) & CHR(10), "</P><P>")
	fString = Replace(fString, CHR(10), "<BR>")
	HTMLEncode2 = fString
end function
dim bookdate,dazhe
dazhe=round(request("huiyuanjia")/request("shichangjia"),2)

dim action,bookid
bookid=request.QueryString("id")
action=request.QueryString("action")
shjianame=request.cookies("bjx")("shjianame")
select case action
case "add"
set rs=server.CreateObject("adodb.recordset")
rs.Open "select * from BJX_goods",conn,1,3
rs.AddNew
rs("shjianame")="易和阳光商城"
rs("shjiaid")=1
rs("anclassid")=int(request("anclassid")) '大类
rs("nclassid")=int(request("nclassid")) '小类
rs("bookname")=trim(request("bookname")) '商品名称
rs("bookad")=trim(request("bookad")) '商品促销话语
rs("pingpai")=trim(request("pingpai")) '商品品牌
rs("isbn")=trim(request("isbn")) '商品规格
rs("bookchuban")=trim(request("bookchuban")) '商品单位
rs("shichangjia")=trim(request("shichangjia"))  '市场价
rs("huiyuanjia")=trim(request("huiyuanjia"))  '会员价
rs("vipjia")=trim(request("vipjia"))  'VIP价
rs("dazhe")=dazhe  '打折
rs("kucun")=trim(request("kucun"))  '商品库存
rs("zhuang")=trim(request("zhuang")) '缩略图片地址
rs("bookpic")=trim(request("bookpic"))  '大图片地址
rs("bookpic1")=trim(request("bookpic1"))  '大图片地址
rs("bookpic2")=trim(request("bookpic2"))  '大图片地址
rs("bookpic3")=trim(request("bookpic3"))  '大图片地址
rs("bookpic4")=trim(request("bookpic4"))  '大图片地址
rs("bookcontent")=trim(request("bookcontent"))  '编辑推荐
rs("bookinfo")=trim(request("bookinfo"))  '简介
rs("bookother1")=trim(request("bookother1"))  '简介
rs("bookother2")=trim(request("bookother2"))  '简介
rs("bookother3")=trim(request("bookother3"))  '简介
rs("bookother4")=trim(request("bookother4"))  '简介
rs("Keywords")=trim(request("Keywords"))  '关键字
rs("Description")=trim(request("Description"))  '说明
rs("yeshu")=trim(request("yeshu"))  '商品积分
if request("bestbook")=1 then  '推荐
rs("bestbook")=1
else
rs("bestbook")=0
end if
if request("newsbook")=1 then  '新品
rs("newsbook")=1
else
rs("newsbook")=0
end if
if request("tejiabook")=1 then  '特价
rs("tejiabook")=1
else
rs("tejiabook")=0
end if
rs("chengjiaocount")=0  '成交计数
rs("liulancount")=0  '浏览计数
rs("adddate")=now()  '加入日期
rs("pingji")=0  '评级人数
rs("pingjizong")=0 '总评级
'rs("bookmulu")=htmlencode2(trim(request("bookmulu")))  '目录
rs.Update
bookid=rs("bookid")
rs.Close
set rs=nothing
response.Write "<script language=javascript>alert('添加成功！返回商品列表！');window.location.href='managebook.asp';</script>"
response.End
case "edit"
set rs=server.CreateObject("adodb.recordset")
rs.Open "select * from BJX_goods where bookid="&bookid,conn,1,3
rs("anclassid")=int(request("anclassid")) '大类
rs("nclassid")=int(request("nclassid")) '小类
rs("bookname")=trim(request("bookname")) '商品名称
rs("bookad")=trim(request("bookad")) '商品促销话语
rs("pingpai")=trim(request("pingpai")) '商品品牌
rs("isbn")=trim(request("isbn")) '商品规格
rs("bookchuban")=trim(request("bookchuban")) '商品单位
rs("shichangjia")=trim(request("shichangjia"))  '市场价
rs("huiyuanjia")=trim(request("huiyuanjia"))  '会员价
rs("vipjia")=trim(request("vipjia"))  'VIP价
rs("dazhe")=dazhe  '打折
rs("kucun")=trim(request("kucun"))  '商品库存
rs("zhuang")=trim(request("zhuang")) '缩略图片地址
rs("bookpic")=trim(request("bookpic"))  '大图片地址
rs("bookpic1")=trim(request("bookpic1"))  '大图片地址
rs("bookpic2")=trim(request("bookpic2"))  '大图片地址
rs("bookpic3")=trim(request("bookpic3"))  '大图片地址
rs("bookpic4")=trim(request("bookpic4"))  '大图片地址
rs("bookcontent")=trim(request("bookcontent"))  '编辑推荐
rs("bookinfo")=trim(request("bookinfo"))  '简介
rs("bookother1")=trim(request("bookother1"))  '简介
rs("bookother2")=trim(request("bookother2"))  '简介
rs("bookother3")=trim(request("bookother3"))  '简介
rs("bookother4")=trim(request("bookother4"))  '简介
rs("Keywords")=trim(request("Keywords"))  '关键字
rs("Description")=trim(request("Description"))  '说明
rs("yeshu")=trim(request("yeshu"))  '商品积分
if request("bestbook")=1 then  '推荐
rs("bestbook")=1
else
rs("bestbook")=0
end if
if request("newsbook")=1 then  '新品
rs("newsbook")=1
else
rs("newsbook")=0
end if
if request("tejiabook")=1 then  '特价
rs("tejiabook")=1
else
rs("tejiabook")=0
end if
rs.Update
rs.Close
set rs=nothing
response.Write "<script language=javascript>alert('修改成功！');window.location.href='managebook.asp';</script>"
response.End
end select
%>