<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<%Const dbdns="../"%>
<script type="text/javascript" language="javascript" runat="server">
function DecodeFilter(html, filter){
	switch(filter.toUpperCase()){
	case "SCRIPT":
		html = execRE("</?script[^>]*>", "", html);
		html = execRE("(javascript|jscript|vbscript|vbs):", "$1：", html);
		html = execRE("on(mouse|exit|error|click|key)", "<I>on$1</I>", html);
		html = execRE("&#", "<I>&#</I>", html);
		break;
	case "TABLE":
		html = execRE("</?table[^>]*>", "", html);
		html = execRE("</?tr[^>]*>", "", html);
		html = execRE("</?th[^>]*>", "", html);
		html = execRE("</?td[^>]*>", "", html);
		break;
	case "CLASS":
		html = execRE("(<[^>]+) class=[^ |^>]*([^>]*>)", "$1 $2", html) ;
		break;
	case "STYLE":
		html = execRE("(<[^>]+) style=\"[^\"]*\"([^>]*>)", "$1 $2", html);
		break;
	case "XML":	
		html = execRE("<\\?xml[^>]*>", "", html);
		break;
	case "NAMESPACE":
		html = execRE("<\/?[a-z]+:[^>]*>", "", html);
		break;
	case "FONT":
		html = execRE("</?font[^>]*>", "", html);
		break;
	case "MARQUEE":
		html = execRE("</?marquee[^>]*>", "", html);
		break;
	case "OBJECT":
		html = execRE("</?object[^>]*>", "", html);
		html = execRE("</?param[^>]*>", "", html);
		html = execRE("</?embed[^>]*>", "", html);
		break;
	default:
	}
	return html;
}

function execRE(re, rp, content){
	oReg = new RegExp(re, "ig");
	r = content.replace(oReg, rp);
	return r; 
}
</script>

<!--#include file="../AppCode/Conn.asp"-->
<%
Content = Trim(Request.Form("Content"))
UserName = Trim(Request.Form("UserName"))
TypeID = Cint(Request.Form("TypeID"))
TableID = Cint(Request.Form("TableID"))
sID = Trim(Request.Form("sID"))
ErrStr = ""

url = "http://" & Request.ServerVariables("SERVER_NAME")
If Request.ServerVariables("SERVER_PORT") = 80 Then
Else
	url = url & ":" & Request.ServerVariables("SERVER_PORT")
End If
url = url & Replace(Request.ServerVariables("PATH_INFO"),"/inc/savebook.asp","/book.asp")
If InStr(Request.ServerVariables("HTTP_REFERER"),url) <> 1 Then
	ErrStr = "验证失败，请重新输入。"
End If

If sID <> Session.SessionID Then
	ErrStr = "验证失败，请重新输入。"
End If

If InStr("|" & Lcase(Application(SiteID & "_Ok3w_SiteUserRegKillName")) & "|","|" & Lcase(UserName) & "|")>0 Then
	ErrStr = "禁止使用该用户发言，请重新输入。"
End If

If ErrStr = "" Then
	Content = DecodeFilter(Content, "SCRIPT")
	Content = DecodeFilter(Content, "XML")
	Content = DecodeFilter(Content, "OBJECT")
	Content = DecodeFilter(Content, "NAMESPACE")
	
	Sql = "select * from Ok3w_Guest where 1=2"
    Rs.Open Sql,Conn,1,3
    Rs.AddNew()
	Rs("pID") = 0
    Rs("UserName") = UserName
	Rs("Content") = Content
	Rs("TypeID") = TypeID
	Rs("TableID") = TableID
	Rs("AddTime") = Now()
	Rs("Ip") = Request.ServerVariables("REMOTE_ADDR")
	Rs("IsPass") = 0
	Rs("IsTop") = 0
	Rs("ReTime") = Now
	Rs("ReUser") = UserName
	Rs("Ad_Ask") = ""
	Rs.Update
	ErrStr = "恭喜，您的留言已经成功提交！管理员审核后，将会显示出来。"
End If

Set Rs = Nothing
Call CloseConn()
%>
<script type="text/javascript">
alert("<%=ErrStr%>");
location.href = "../book.asp";
</script>