<%
dim conn,connstr,startime,TimesDB,rs,UserAgent
startime=timer()
'数据库类别，1为SQL数据库，0为Access数据库
Const IsSqlDataBase = 0
'数据库名称和路径
TimesDB="Data/#wygkcnshop.asp"
UserAgent = Trim(Lcase(Request.Servervariables("HTTP_USER_AGENT")))
If InStr(UserAgent,"teleport") > 0 or InStr(UserAgent,"webzip") > 0 or InStr(UserAgent,"flashget")>0 or InStr(UserAgent,"offline")>0 Then
	Response.Write "请不要采用teleport/Webzip/Flashget/Offline等工具来浏览商城！"
	Response.End
End If

Function SafeRequest(ParaName,ParaType)
       Dim ParaValue
       ParaValue=Request(ParaName)
       If ParaType=1 then
              If not isNumeric(ParaValue) then
                     Response.write "<center>参数" & ParaName & "必须为数字型，请正确操作！</center>"
                     Response.end
              End if
       Else
              ParaValue=replace(ParaValue,"'","''")
       End if
       SafeRequest=ParaValue
End function


Function FormatSQL(strChar)
if strChar="" then
FormatSQL=""
else
FormatSQL=replace(replace(replace(replace(replace(replace(replace(replace(strChar,"'","’"),"*","×"),"?","？"),"(","（"),")","）"),"<","〈"),".","。"),";","；")
end if
End Function 

Dim Fy_Url,Fy_a,Fy_x,Fy_Cs(),Fy_Cl,Fy_Ts,Fy_Zx
Fy_Cl = 1		'处理方式：1=提示信息,2=转向页面,3=先提示再转向
Fy_Zx = "index.Asp"	'出错时转向的页面
On Error Resume Next
Fy_Url=Request.ServerVariables("QUERY_STRING")
Fy_a=split(Fy_Url,"&")
redim Fy_Cs(ubound(Fy_a))
On Error Resume Next
for Fy_x=0 to ubound(Fy_a)
Fy_Cs(Fy_x) = left(Fy_a(Fy_x),instr(Fy_a(Fy_x),"=")-1)
Next
For Fy_x=0 to ubound(Fy_Cs)
If Fy_Cs(Fy_x)<>"" Then
If Instr(LCase(Request(Fy_Cs(Fy_x))),"'")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"and")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"select")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"update")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"chr")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"delete%20from")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),";")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"insert")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"mid")<>0 Or Instr(LCase(Request(Fy_Cs(Fy_x))),"master.")<>0 Then
Select Case Fy_Cl
  Case "1"
Response.Write "<Script Language=JavaScript>alert('                   出现错误！参数 "&Fy_Cs(Fy_x)&" 的值中包含非法字符串！\n\n  请不要在参数中出现：;,and,select,update,insert,delete,chr 等非法字符！');window.close();</Script>"
  Case "2"
Response.Write "<Script Language=JavaScript>location.href='"&Fy_Zx&"'</Script>"
  Case "3"
Response.Write "<Script Language=JavaScript>alert('                   出现错误！参数 "&Fy_Cs(Fy_x)&"的值中包含非法字符串！\n\n  请不要在参数中出现：;,and,select,update,insert,delete,chr 等非法字符！');location.href='"&Fy_Zx&"';</Script>"
End Select
Response.End
End If
End If
Next

connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(""&TimesDB&"")
On Error Resume Next
	Set conn = Server.CreateObject("ADODB.Connection")
	conn.open connstr
	If Err Then
		err.Clear
		Set Conn = Nothing
		Response.Write "数据库连接出错，请检查Conn.asp中的数据库指向。"'
		Response.End
	End If
	
Dim strTitle,LngDiscount,strUserName,LngUserID,LngGrpID,LngDeposit,rsVip,strUserEmail
LngDiscount = 1
LngUserID = 0
LngDeposit = 0
strUserName = "非注册用户"
strTitle = "非注册用户"
if Request.Cookies("timesshop")("username")<>"" then 
set rsVip=server.CreateObject("adodb.recordset")
rsVip.open "select [User].GrpID,[User].UserID,[User].Score,[User].UserEmail,[User].Deposit,[User].UserName,TimesGrp.GrpName,TimesGrp.Stars from [User] Inner Join TimesGrp On [User].GrpID = TimesGrp.GrpID where username='"&request.Cookies("timesshop")("username")&"' ",conn,1,1
strTitle = rsVip("GrpName")
LngDiscount = rsVip("Stars")
LngGrpID = Clng(rsVip("GrpID"))
strUserName = rsVip("UserName")
LngUserID = Clng(rsVip("UserID"))
LngScore = Clng(rsVip("Score"))
LngDeposit = rsVip("Deposit")
strUserEmail = rsVip("UserEmail")
rsVip.close
set rsVip=nothing 
End If

Select Case LngGrpID
Case "" 
LstPrice = "Price1"

Case 4
LstPrice = "Price2"

Case 30
LstPrice = "Price3"

Case 31
LstPrice = "Price4"

Case 32
LstPrice = "Price5"

End Select
%>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="include/css.css" rel="stylesheet" type="text/css">