<%@ LANGUAGE = VBScript CodePage = 936%>
<%Server.ScriptTimeOut=72000%>
<!--#include file="config.asp"-->
<!--#include file="md5.asp"-->
<%



'--------版权说明------------------
'SQL通用防注入程序 完美版 

'--------定义部份------------------
Dim Fy_Post,Fy_Get,Fy_In,Fy_Inf,Fy_Xh,Fy_db,Fy_dbstr,alerts
'自定义需要过滤的字串,用 "|" 分隔
Fy_In = "'|;|(|)|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
'----------------------------------


Fy_Inf = split(Fy_In,"|")
'--------POST部份------------------
If Request.Form<>"" Then
For Each Fy_Post In Request.Form
    For Fy_Xh=0 To Ubound(Fy_Inf)
      If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh))<>0 Then
   call e_alert()
      End If
    Next
Next
End If

'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString
    For Fy_Xh=0 To Ubound(Fy_Inf)
      If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
   call e_alert()
      End If
    Next
Next
End If

'--------cookies部份-------------------
If Request.Cookies<>"" Then
For Each Fy_Get In Request.Cookies
    For Fy_Xh=0 To Ubound(Fy_Inf)
      If Instr(LCase(Request.Cookies(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
   call e_alert()
      End If
    Next
Next
End If

Sub e_alert()
Response.Write "<Script Language=JavaScript>alert('系统提示你↓\n\n对不起，您提交的内容包含非安全字符！');</Script>"
response.Write "<script LANGUAGE='javascript'>history.go(-1);</script>"
response.End
end Sub








Response.Buffer = True
randomize timer
Dim db,verStr
Dim SqlNowString,Conn
dim Rs,Rs1,Rs2
dim mssql
Sub ConnectionDatabase
	Dim ConnStr

	connstr="driver={SQL Server};server="&sqlip&",1433;uid="&sqluid&";pwd="&sqlpwd&";database="&sqlname&""
	On Error Resume Next
	Set conn = Server.CreateObject("ADODB.Connection")
	conn.open ConnStr
	If Err Then
		err.Clear
		Set Conn = Nothing
		Response.Write "服务器繁忙，请刷新或稍后再试..."
		Response.End
	End If

End Sub

Function GrateRs(SqlStr,wr)
	dim Rs
        Set Rs=Server.CreateObject("ADODB.Recordset")
		On Error Resume Next
	Rs.Open SqlStr, Conn, 1, wr
        set GrateRs=Rs
	If Err Then
		err.Clear
		Set Conn = Nothing
		Response.Write "服务器繁忙，请刷新或稍后再试..."
		Response.End
	End If
End Function




Function ReplStr(s)
	s=Replace(s,"'","’")
	s=Replace(s,"%","％")
	s=Replace(s,"&","＆")
	s=Replace(s,"<","&lt;")
	s=Replace(s,">","&gt;")
	s=replace(s,chr(13)+chr(10),"<br>")
	s=Replace(s," ","&nbsp;")
	ReplStr=s
End Function

'防SQL注入函数
Function YeSqlStr(data,falgs)
 select case falgs
  case "1"  '数值型
    data= data
    if not isNumeric (data) then data=0
  case "2"  '字符型
    data = Replace (data, "'", "''" )
  case else  '字符串
    data = Trim(Replace(data, "&", "&amp;"))
    data = replace(data, "<", "&lt;")
    data = replace(data, ">", "&gt;")
    data = replace(data, "'", """")
    data = replace(data, "*", "")
    data = replace(data, "?", "")
    data = replace(data, "select", "")
    data = replace(data, "insert", "")
    data = replace(data, "delete", "")
    data = replace(data, "update", "")
    data = replace(data, "delete", "")
    data = replace(data, "create", "")
    data = replace(data, "drop", "")
    data = replace(data, "declare", "")
    data = replace(data, vbCrLf&vbCrlf, "</p><p>")
    data = replace(data, vbCrLf, "<br>")
  end select
  YeSqlStr= data
End Function




Sub DBConnEnd()
	On Error Resume Next
	Rs.Close
	Set Rs = Nothing
	Conn.Close
	Set Conn = Nothing
End Sub

Sub payoption(x)
	Dim Rs
	Response.Write "<option value='0' >所有支付方式</option>"
	set Rs=GrateRs("select id,Pname from H_plist where fenzu<>0 order by paixu",2)
	do while not Rs.eof
		Response.Write "<option value='"&Rs("id")&"'"
		If Rs("id")=x Then Response.Write " selected "
		Response.Write ">"&Rs("Pname")&"</option>"
		Rs.movenext
	loop 
End sub

function zero(num)
if left(num,1)="." and IsNumeric(right(num,1)) then
zero="0"&Num
else
zero=num
end if
end function






function ClearSQL(p)
	  p=Lcase(p)
      SQLin = "'|;|exec|insert|and|select|delete|update|count|%|&|chr|mid|master|truncate|char|declare"
	  SQLin2=split(SQLin,"|")
	  for i=0 to Ubound(SQLin2)
	      if instr(p,SQLin2(i))<>0 then p=replace(p,SQLin2(i),"")
	  next
	  ClearSQL=p
end function




%>
