%
xDb_Conn_Str=""
xDb_Conn_Str = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & server.mappath("data/52yujdb2.asp") & ";"
set conn = Server.CreateObject("ADODB.Connection")
conn.Open xDb_Conn_Str
If Err Then
err.Clear
Set conn = Nothing
Response.Write "数据库连接出错,请检查连接字串。"
Response.End
End If
function getsub(tempstr,leftn)
If IsNull(tempstr) Or tempstr = "" Then
getsub = ""
Else
Dim i, n, k, chrA
k = 0
n = Len(tempstr)
For i = 1 To n
chrA = Mid(tempstr, i, 1)
If Asc(chrA) >= 0 And Asc(chrA) <= 255 Then
k = k + 1
Else
k = k + 2
End If
if k>=leftn*2 then
getsub=left(tempstr,i)
Exit Function
end if
Next
getsub=tempstr
end if
end function
function intSql(Numeric)
if IsNumeric(Numeric) then
intSql=Numeric
else
intSql=0
end if
end function
'--------定义部份------------------
Dim Fy_Post,Fy_Get,Fy_In,Fy_Inf,Fy_Xh,Fy_db,Fy_dbstr
'自定义需要过滤的字串,用 "|" 分隔
Fy_In = "'|;|and|(|)|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|or"
'----------------------------------
Fy_Inf = split(Fy_In,"|")
'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString
For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
Response.Write ""
Response.Write "非法操作!系统做了如下记录↓ "
Response.Write "操作IP:"&Request.ServerVariables("REMOTE_ADDR")&" "
Response.Write "操作时间:"&Now&" "
Response.Write "操作页面:"&Request.ServerVariables("URL")&" "
Response.Write "提交方式:GET "
Response.Write "提交参数:"&Fy_Get&" "
Response.Write "提交数据:"&Request.QueryString(Fy_Get)
Response.End
End If
Next
Next
End If
%>