<%@ LANGUAGE = VBScript.Encode %>
<%
Option Explicit
Response.Buffer = True

Dim Conn,Db,PagePath
Dim Db_C,Conn_C
Dim Qsite


PagePath = ""


Db = "Data/Dafdsafsd23234ta.mdb"

Db_C = "Data/contactfdsafadsa.mdb"

Session.Timeout = 60

Sub ConnectionDatabase()
	Dim ConnStr
	
	ConnStr = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(PagePath & Db)
	
	On Error Resume Next
	Set Conn = Server.CreateObject("ADODB.Connection")
	Conn.open ConnStr
	If Err Then
		err.Clear
		Set Conn = Nothing
		Response.Write "数据库连接出错，请检查连接字串。"
		Response.End
	End If
End Sub

Sub ConnectionDatabase_C()
	Dim ConnStr
	
	ConnStr = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(PagePath & Db_C)
	
	On Error Resume Next
	Set Conn_C = Server.CreateObject("ADODB.Connection")
	Conn_C.open ConnStr
	If Err Then
		err.Clear
		Set Conn_C = Nothing
		Response.Write "数据库连接出错，请检查连接字串。"
		Response.End
	End If
End Sub

Sub F_Sql()
	Dim Q_Post,Q_Get,Q_In,Q_Inf,i
	'Q_In = "'|and|exec|insert|select|delete|update|count|*|chr|mid|master|truncate|char|declare"
	Q_In = "'|exec|insert|select|delete|update|*|truncate|declare"
	
	Q_Inf = Split(Q_In , "|")
	
	If Request.Form <> "" Then
		For Each Q_Post In Request.Form
			For i = 0 To Ubound(Q_Inf)
				If InStr(LCase(Request.Form(Q_Post)) , Q_Inf(i)) <> 0 Then
					Response.Write("请不要在参数中包含非法字符尝试注入1")
					Response.End()
				End If
			Next
		Next
	End If
	
	If Request.QueryString <> "" Then
		For Each Q_Get In Request.QueryString
			For i = 0 To Ubound(Q_Inf)
				If InStr(LCase(Request.QueryString(Q_Get)) , Q_Inf(i)) <> 0 Then
					Response.Write("请不要在参数中包含非法字符尝试注入2")
					Response.End()
				End If
			Next
		Next
	End If
	
End Sub

F_Sql()
%>                                                                                              
