<!--#Include File="../Inc/SysTem.Asp"-->
<!--#include file="SqlIn_Config.asp"-->
<!--#include file="SqlIn_Conn.asp"-->
<%
PurviewValue="Admin_Sql"
If not CheckAdmin(PurviewValue) then
Response.Write("<script language=""JavaScript"">alert(""越权操作!"");history.go(-1);")
response.end
End If
%>
<html>
<head>
<title>网站管理系统</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="Images/Admin.css" rel="stylesheet" type="text/css">
<body>
<table width="98%" align="center" border="1" cellspacing="0" cellpadding="4" class=tablebk style="border-collapse: collapse">
<tr><td class=tablebg align="center" colspan="2">Sql防注入管理</td></tr>
  <tr class=tableinfo>
    <td align="center" width>管理导航</td>
	<td align="center"><a href="?">管理首页</a> | <a href="?action=Set">系统设置</a></td>
  </tr>
</table>
<%
URL						= Request.ServerVariables("URL")
Action					= Request("Action")
ObjName="Scripting.FileSystemObject"  'fso组建
InstallFile="SqlIn_Config.Asp"      '文件保存地址
ObjInstalled=IsObjInstalled(ObjName)

Function HTMLEncode(urlString)

 urlString = replace(urlString, ">", "&gt;")
 urlString = replace(urlString, "<", "&lt;")

 urlString = Replace(urlString, CHR(13), "")
 urlString = Replace(urlString, CHR(10) & CHR(10), "</P><P>")
 urlString = Replace(urlString, CHR(10), "<BR>")
 HTMLEncode = urlString
End Function

If Action="del" Then
	Call Delip()
ElseIf Action="lock" Then
	Call lockIP()
ElseIf Action="unlock" Then
	Call UnLockip()
ElseIf Action="Set" Then
	Call SetConfig()
ElseIf Action="SaveConfig" Then
	Call SaveConfig()	
Else
	Call Main()
End If

Sub Delip()
dim id 
id = clng(request("id"))
killSqlconn.execute("delete from SqlIn where id="&id)
Call Main()
End sub

Sub Lockip()
id = clng(request("id"))
killSqlconn.execute("update SqlIn set Kill_ip=true where id="&id)
Call Main()
End sub

Sub UnLockip()
id = clng(request("id"))
killSqlconn.execute("update SqlIn set Kill_ip=False where id="&id)
Call Main()
End sub

Sub Main()
%>
<table width="98%" align="center" border="1" cellspacing="0" cellpadding="4" class=tablebk style="border-collapse: collapse">
<tr Class=tableMain>
<%
sql="select * from SqlIn order by id desc"
set rs=server.createobject("adodb.recordset")
rs.open sql,killSqlconn,1,1
if rs.eof and rs.bof then
	response.write "暂无内容"
else
'分页的实现 
listnum=10
Rs.pagesize=listnum
page=Request("page")
if (page-Rs.pagecount) > 0 then
page=rs.pagecount
elseif page = "" or page < 1 then
page = 1
end if
rs.absolutepage=page
'编号的实现
j=rs.recordcount
j=j-(page-1)*listnum
i=0
nn=request("page")
if nn="" then
n=0
else
nn=nn-1
n=listnum*nn
end if%>
 <td width="5%" height=20>编号</td>
 <td width="10%"><font color=red>操作ＩＰ</font></td>
 <td width="10%">是否锁定</td>
 <td width="20%">操作页面</td>
 <td width="10%">操作时间</td>
 <td width="10%">提交方式</td>
 <td width="10%">提交参数</td>
 <td width="10%">提交数据</td>
 <td width="10%">操作</td>
</tr>
<%do while not rs.eof and i<listnum
n=n+1%>
<tr class="Tableinfo">
 <td><%=n%></td>
 <td><%=rs("SqlIn_IP")%>
</td>
<td><%	if rs("Kill_ip")=true then 
			response.write "<font color='red'>已锁定</font>"
		else
			response.write "<font color='green'>已解锁</font>"
		end if
	%></td>
 <td><%=rs("SqlIn_WEB")%></td>
 <td><%=rs("SqlIn_TIME")%></td>
 <td><%=rs("SqlIn_FS")%></td>
 <td><%=rs("SqlIn_CS")%></td>
 <td><%=HTMLEncode(rs("SqlIn_SJ"))%></td>
 <td><a href=<%=URL%>?action=del&id=<%=rs("id")%>>删除</a>&nbsp;
 <%	if rs("Kill_ip")=true then 
			response.write "<a href="&URL&"?action=unlock&id="&rs("id")&">解锁IP</a>"
		else
			response.write "<a href="&URL&"?action=lock&id="&rs("id")&">锁定IP</a>"
		end if
	%>
 
 </td>
</tr>
<%rs.movenext 
i=i+1 
j=j-1
loop%>
<tr class="TableInfo">
<%filename=URL%>
<td colspan=9 align=right><%=Rs.recordcount%> 条记录&nbsp;&nbsp;<%=listnum%> 条记录/页&nbsp;&nbsp;共 <%=rs.pagecount%> 页 
      <% if page=1 then %>
      <%else%>
      <a href=<%=filename%>><strong>|<<</strong></a>
      <a href=<%=filename%>?page=<%=page-1%>><strong><<</strong></a>
      <a href=<%=filename%>?page=<%=page-1%>><b>[<%=page-1%>]</b></a>
      <%end if%><% if rs.pagecount=1 then%><%else%><b>[<%=page%>]</b><%end if%>
	  <% if rs.pagecount-page <> 0 then %>
      <a href=<%=filename%>?page=<%=page+1%>><b>[<%=page+1%>]</b></a>
      <a href=<%=filename%>?page=<%=page+1%>><strong>>></strong></a>
      <a href=<%=filename%>?page=<%=rs.pagecount%>><strong>>>|</strong></a>
	  <%end if%></td>
<%end if%></tr> 
<TR class="Tablemain" align="right">
	<td colspan=9><a href="http://www.melyysoft.com" target="_blank">Power By MelyySoft.Com</a></TD>
</TR>
</TABLE>
<%
end sub
sub SetConfig()
%>
  <table width="98%" align="center" border="1" cellspacing="0" cellpadding="4" class=tablebk style="border-collapse: collapse">
  <form method="POST" action="?" id="form" name="form">
    <tr class="tableinfo"> 
      <td align="right" width="40%">系统信息：</td>
      <td><input name="SqlInSystem" type="text" value="<%=SqlInSystem%>" size="20">系统提示时显示信息</td>
    </tr>
    <tr class="tableinfo"> 
      <td align="right">免保护文件或者目录</td>
      <td><textarea name="SqlInOutUrl" cols="50" rows="5"><%=SqlInOutUrl%></textarea>
	  <br>建议写完整文件名或者目录，多个用英文,搁开</td>
    </tr>
    <%
If ObjInstalled=false Then
	Response.Write "<tr class='tablemain'><td height='40' colspan='3'><b><font color=red>你的服务器不支持 FSO(Scripting.FileSystemObject)! 不能使用本功能。<br>请直接修改“Inc/config.asp”文件中的内容。</font></b></td></tr>"
	else%>
	<tr class="tableinfo"> 
      <td align="center" colspan="2">经检测，您的平台环境可以正常运行本系统。请进入下一步！</td>
    </tr>
	<tr class="tableMain">
      <td colspan="2" align="center">      
	    <input name="Action" type="hidden" id="Action" value="SaveConfig">
        <input name="cmdSave" type="submit" id="cmdSave" value="下一步">
		<input name="submit" type="reset" value="重置">
		</td>
    </tr>
<%	
End If
%>
  </table>
<%
end sub
%>
</form>
<%
sub SaveConfig()
    If ObjInstalled=false Then
		FoundErr=True
		ErrMsg=ErrMsg & "<br><li>你的服务器不支持 "&ObjNmae&"! </li>"
		exit sub
	end if
	SqlInSystem=trim(request.Form("SqlInSystem"))
	If request.Form("SqlInOutUrl")<>"" then
		SqlInOutUrl=trim(request.Form("SqlInOutUrl"))
	End if
	If SqlInSystem="" then
	    Response.Write("<script language=javascript>alert('系统信息不能为空!');history.go(-1);</script>")
		response.end
	End if   	   
	dim fso,hf
	set fso=Server.CreateObject(ObjName)
	set hf=fso.CreateTextFile(Server.mappath(InstallFile),true)
	hf.write "<" & "%" & vbcrlf
	hf.write "Dim SqlInSystem,SqlInOutUrl"& vbcrlf
	hf.write "SqlInSystem=" & chr(34) & SqlInSystem & chr(34) & "     '系统信息" & vbcrlf
	hf.write "SqlInOutUrl=" & chr(34) & SqlInOutUrl & chr(34) & "     '免保护文件或者目录！" & vbcrlf
	hf.write "%" & ">"
	hf.close
	set hf=nothing
	set fso=nothing
	Response.Write("<script language=javascript>alert('操作成功!');this.location.href='?';</script>")
  response.end
end sub
'***************************************************
'函数名：IsObjInstalled
'作  用：检查组件是否已经安装
'参  数：strClassString ----组件名
'返回值：True  ----已经安装
'       False ----没有安装
'***************************************************
Function IsObjInstalled(strClassString)
	On Error Resume Next
	IsObjInstalled = False
	Err = 0
	Dim xTestObj
	Set xTestObj = Server.CreateObject(strClassString)
	If 0 = Err Then IsObjInstalled = True
	Set xTestObj = Nothing
	Err = 0
End Function
%>