久久久电脑

<%
Dim Query_Badword,Form_Badword,i,Err_Message,Err_Web,name
'------定义部份   头----------------------------------------------------------------------
Err_Message = 1         '处理方式：1=提示信息,2=转向页面,3=先提示再转向
'Err_Web = "Err.Asp"     '出错时转向的页面
Err_Web = "http://www.oyaya.net"     '出错时转向的页面
Query_Badword="'∥or∥and∥select∥update∥chr∥delete∥%20from∥;∥insert∥mid∥master.∥set∥chr(37)∥="    
'在这部份定义get非法参数,使用"∥"号间隔    
Form_Badword=""     '在这部份定义post非法参数,使用"∥"号间隔
'Form_Badword="'∥%∥&∥*∥#∥=∥or"     '在这部份定义post非法参数,使用"∥"号间隔
'------定义部份   尾-----------------------------------------------------------------------
'
On Error Resume Next
'----- 对 get query 值 的过滤.
if request.QueryString<>"" then
Chk_badword=split(Query_Badword,"∥")
FOR EACH Query_Name IN Request.QueryString
for i=0 to ubound(Chk_badword)
If Instr(LCase(request.QueryString(Query_Name)),Chk_badword(i))<>0 Then
Select Case Err_Message
   Case "1"
Response.Write "<Script Language=JavaScript>alert('传参错误！参数 "&name&" 的值中包含非法字符串！\n\n请不要在参数中出现：and update delete ; insert mid master 等非法字符！');window.close();</Script>"
   Case "2"
Response.Write "<Script Language=JavaScript>location.href='"&Err_Web&"'</Script>"
   Case "3"
Response.Write "<Script Language=JavaScript>alert('传参错误！参数 "&name&"的值中包含非法字符串！\n\n请不要在参数中出现：and update delete ; insert mid master 等非法字符！');location.href='"&Err_Web&"';</Script>"
End Select
Response.End
End If
NEXT
NEXT
End if
'-----对 post 表 单值的过滤.
if request.form<>"" then
Chk_badword=split(Form_Badword,"∥")
FOR EACH name IN Request.Form
for i=0 to ubound(Chk_badword)
If Instr(LCase(request.form(name)),Chk_badword(i))<>0 Then
Select Case Err_Message
   Case "1"
Response.Write "<Script Language=JavaScript>alert('出错了！表单 "&name&" 的值中包含非法字符串！\n\n请不要在表单中出现： % & * # ( ) 等非法字符！');window.close();</Script>"
   Case "2"
Response.Write "<Script Language=JavaScript>location.href='"&Err_Web&"'</Script>"
   Case "3"
Response.Write "<Script Language=JavaScript>alert('出错了！参数 "&name&"的值中包含非法字符串！\n\n请不要在表单中出现： % & * # ( )   等非法字符！');location.href='"&Err_Web&"';</Script>"
End Select
Response.End
End If
NEXT
NEXT
end if
%>

<%
dim strFileName,MaxPerPage,ShowSmallClassType
……
BeginTime=Timer
BigClassName=Trim(request("BigClassName"))
SmallClassName=Trim(request("SmallClassName"))
keyword=trim(request("keyword"))
if keyword<>"" then
   keyword=replace(replace(replace(replace(keyword,"'","‘"),"<","<"),">",">")," "," ")
end if
strField=trim(request("Field"))
……
%>

sub ShowDown(TitleLen)
…………
     if currentPage=1 then
         sqlDown="select top " & MaxPerPage   
     else
         sqlDown="select "
     end if
     sqlDown=sqlDown & " ID,title,content,BigClassName,SmallClassName,System,Language,Softclass,PhotoUrl,DownloadUrl,FileSize,Hits,AddDate from download"
   
     if BigClassName<>"" then
        sqlDown=sqlDown & " where BigClassName='" & BigClassName & "' "
         if SmallClassName<>"" then
            sqlDown=sqlDown & " and SmallClassName='" & SmallClassName & "' "         end if   
     end if
     sqlDown=sqlDown & " order by AddDate desc"
     Set rsDown= Server.CreateObject("ADODB.Recordset")
     rsDown.open sqlDown,conn,1,1
     if rsDown.bof and   rsDown.eof then
         response.Write("<br><li>没有任何下载</li>")
     else
…………
end sub

<%
key=request("key")
otype=request("otype")
if key="" then
   response.write "<script>alert('查找字符串不能为空！');history.back();</script>"
   response.end
end if
…………
page=clng(request("page"))   
set rs= server.createobject("adodb.recordset")
if otype="title" then
sql="select * from news where title like '%"& key &"%' order by id desc"
elseif otype="msg" then
sql="select * from news where content like '%"& key &"%' order by id desc"
elseif otype="dtitle" then
sql="select * from Download where title like '%"& key &"%' order by id desc"
elseif otype="dmsg" then
sql="select * from Download where Content like '%"& key &"%' order by id desc"
end if
rs.open sql,conn,1,1
if rs.eof and rs.bof then
response.write "<tr bgcolor='#ffffff'><td colspan='4'><p align='center'>对不起，没有找到相关新闻</p></td></tr>"
else
%>