<%
On Error Resume Next
If Request.QueryString <> "" Then Call StopHacker(Request.QueryString, "'|<[^>]+?style=[\w]+?:expression\(|<[^>]*?=[^>]*?&#[^>]*?>|\b(alert|confirm|prompt)\b|^\+/v(8|9)|\bonmouse(over|move)=\b|\b(and|or)\b.+?(>|<|=|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
If Request.ServerVariables("HTTP_REFERER") <> "" Then Call Test(Request.ServerVariables("HTTP_REFERER"), "'|\b(and|or)\b.+?(>|<|=|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
If Request.Cookies <> "" Then Call StopHacker(Request.Cookies, "\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
Call StopHacker(Request.Form, "<[^>]+?style=[\w]+?:expression\(|\bonmouse(over|move)=\b|\b(alert|confirm|prompt)\b|^\+/v(8|9)|<[^>]*?=[^>]*?&#[^>]*?>|\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|<\s*img\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")

Function Test(values, re)
    Dim regex
    Set regex = New regexp
    regex.IgnoreCase = True
    regex.Global = True
    regex.Pattern = re
    If regex.Test(values) Then
        IP = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
        If IP = "" Then
            IP = Request.ServerVariables("REMOTE_ADDR")
        End If
        slog("操作IP：" & ip & "<br />操作时间：" & Now() & "<br />操作页面：" & Request.ServerVariables("URL") & "<br />提交方式：" & Request.ServerVariables("Request_Method") & "<br />提交参数：" & l_get & "<br />提交数据：" & l_get2 & "<hr>")
        Response.Write("<div style=""font-size: 12px; margin: 10px; line-height: 20px;"">警告：由于您提交的内容中含有危险的SQL注入代码，本次操作无效！<br />有任何疑问请登录千博企业网站管理系统官方网站获取帮助：http://www.Qianbo.com.cn/</div>")
        Response.End
    End If
    Set regex = Nothing
End Function

Function StopHacker(values, re)
    Dim l_get, l_get2, n_get, regex, IP
    For Each n_get in values
        For Each l_get in values
            l_get2 = values(l_get)
            Set regex = New regexp
            regex.IgnoreCase = True
            regex.Global = True
            regex.Pattern = re
            If regex.Test(l_get2) Then
                IP = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
                If IP = "" Then
                    IP = Request.ServerVariables("REMOTE_ADDR")
                End If
                slog("操作IP：" & ip & "<br />操作时间：" & Now() & "<br />操作页面：" & Request.ServerVariables("URL") & "<br />提交方式：" & Request.ServerVariables("Request_Method") & "<br />提交参数：" & l_get & "<br />提交数据：" & l_get2 & "<hr>")
                Response.Write("<div style=""font-size: 12px; margin: 10px; line-height: 20px;"">警告：由于您提交的内容中含有危险的SQL注入代码，本次操作无效！<br />有任何疑问请登录千博企业网站管理系统官方网站获取帮助：http://www.Qianbo.com.cn/</div>")
                Response.End
            End If
            Set regex = Nothing
        Next
    Next
End Function

Sub slog(logs)
    Dim toppath, fs, Ts
    toppath = Server.Mappath("/log.htm")
    Set fs = CreateObject("Scripting.FileSystemObject")
    If Not Fs.FileExists(toppath) Then
        Set Ts = fs.CreateTextFile(toppath, True)
        Ts.Close
    End If
    Set Ts = Fs.OpenTextFile(toppath, 8)
    Ts.WriteLine (logs)
    Ts.Close
    Set Ts = Nothing
    Set fs = Nothing
End Sub

Function CheckBadChar(strChar)
    Dim strBadChar, arrBadChar, i
    strBadChar = "@@,+,',%,^,&,?,(,),<,>,[,],{,},/,\,;,:," & Chr(34) & ",--,union,select,insert,delete,from"
    arrBadChar = Split(strBadChar, ",")
    If strChar = "" Then
        CheckBadChar = False
    Else
        Dim tempChar
        tempChar = LCase(strChar)
        For i = 0 To UBound(arrBadChar)
            If InStr(tempChar, arrBadChar(i)) > 0 Then
                CheckBadChar = False
                Exit Function
            End If
        Next
    End If
    CheckBadChar = True
End Function

Function ReplaceBadChar(strChar)
    If strChar = "" Or IsNull(strChar) Then
        ReplaceBadChar = ""
        Exit Function
    End If
    Dim strBadChar, arrBadChar, tempChar, i
    strBadChar = "+,',%,^,&,?,(,),<,>,[,],{,},/,\,;,:," & Chr(34) & "," & Chr(0) & ",--"
    arrBadChar = Split(strBadChar, ",")
    tempChar = strChar
    For i = 0 To UBound(arrBadChar)
        tempChar = Replace(tempChar, arrBadChar(i), "")
    Next
    tempChar = Replace(tempChar, "@@", "@")
    ReplaceBadChar = tempChar
End Function
%>