<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%>
<HTML xmlns="http://www.w3.org/1999/xhtml">
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8" />
<META NAME="copyright" CONTENT="Copyright 2004-2008" />
<META NAME="Author" CONTENT="迅易评选管理系统" />
<META NAME="Keywords" CONTENT="" />
<META NAME="Description" CONTENT="" />
<TITLE>防注入记录</TITLE>
<link rel="stylesheet" href="Images/CssAdmin.css">
<script language="javascript" src="../Script/Admin.js"></script></HEAD>

<!--#include file="../Include/ConnSiteData.asp" -->
<!--#include file="../Include/Const.asp" -->
<!--#include file="CheckAdmin.asp"-->
<%
if Instr(session("AdminPurview"),"|71,")=0 then 
  response.write ("<font color='red')>你不具有该管理模块的操作权限，请返回！</font>")
  response.end
end if
'========判断是否具有管理权限
%>
<BODY>
<%
URL						= Request.ServerVariables("URL")
Action					= Request("Action")

	Select Case Action
		Case "Del"
			Call Delip()
		Case "lock"
			Call lockIP()
		Case "unlock"
			Call UnLockip()
		Case "config"
			Call config()
		Case "saveconfig"
			Call saveconfig()
		Case Else 
			Call Main()
    end Select

Sub Main()
	Call header()
%>
<script language="JavaScript">
<!--
function CheckAll(form)  {
  for (var i=0;i<form.elements.length;i++)    {
    var e = form.elements[i];
    if (e.name != 'chkall')       e.checked = form.chkall.checked; 
   }
  }
//-->
</script> 
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#6298E1">
<tr align=center >
<%
sql="select * from ameav_SqlIn order by id desc"
set rs=server.createobject("adodb.recordset")
rs.open sql,conn,1,1
if rs.eof and rs.bof then
	response.write "暂无内容"
else
'分页的实现 
listnum=20
Rs.pagesize=listnum
page=Request("page")
if (page-Rs.pagecount) > 0 then
page=rs.pagecount
elseif page = "" or page < 1 then
page = 1
end if
rs.absolutepage=page
'编号的实现
j=rs.recordcount
j=j-(page-1)*listnum
i=0
nn=request("page")
if nn="" then
n=0
else
nn=nn-1
n=listnum*nn
end if%>
 <td height=20>编号</td>
 <td><font color=red>操作ＩＰ</font></td>
 <td>是否锁定</td>
 <td>操作</td>
 <td>操作页面</td>
 <td>操作时间</td>
 <td>提交方式</td>
 <td>提交参数</td>
 <td>提交数据</td>
 
</tr>
<%do while not rs.eof and i<listnum
n=n+1%>
<form action="<%=url%>?Action=Del" method=post name=check>
<tr align=center bgcolor="#FFFFFF" height=22>
 <td bgcolor="#FFFFFF"><input name="ID" type="checkbox" id="ID" value=<%=rs("id")%>><%=n%></td>
 <td bgcolor="#FFFFFF"><%=rs("SqlIn_IP")%>
</td>

<td bgcolor="#FFFFFF"><%	if rs("Kill_ip")=true then 
			response.write "<font color='red'>已锁定</font>"
		else
			response.write "<font color='green'>已解锁</font>"
		end if
	%></td>
 <td bgcolor="#FFFFFF">
 <%	if rs("Kill_ip")=true then 
			response.write "<a href="&URL&"?action=unlock&id="&rs("id")&">解锁IP</a>"
		else
			response.write "<a href="&URL&"?action=lock&id="&rs("id")&">锁定IP</a>"
		end if
	%>
 
 </td>
 <td bgcolor="#FFFFFF"><%=rs("SqlIn_WEB")%></td>
 <td bgcolor="#FFFFFF"><%=rs("SqlIn_TIME")%></td>
 <td bgcolor="#FFFFFF"><%=rs("SqlIn_FS")%></td>
 <td bgcolor="#FFFFFF"><%=rs("SqlIn_CS")%></td>
 <td bgcolor="#FFFFFF"><%=N_Replace(rs("SqlIn_SJ"))%></td>
</tr>
<%rs.movenext 
i=i+1 
j=j-1
loop%>
<tr bgcolor="#FFFFFF">
<%filename=URL%>
<td colspan=9 align=right bgcolor="#FFFFFF"><%=Rs.recordcount%> 条记录&nbsp;&nbsp;<%=listnum%> 条记录/页&nbsp;&nbsp;共 <%=rs.pagecount%> 页 
      <% if page=1 then %>
      <%else%>
      <a href=<%=filename%>><strong>|<<</strong></a>
      <a href=<%=filename%>?page=<%=page-1%>><strong><<</strong></a>
      <a href=<%=filename%>?page=<%=page-1%>><b>[<%=page-1%>]</b></a>
      <%end if%><% if rs.pagecount=1 then%><%else%><b>[<%=page%>]</b><%end if%>
	  <% if rs.pagecount-page <> 0 then %>
      <a href=<%=filename%>?page=<%=page+1%>><b>[<%=page+1%>]</b></a>
      <a href=<%=filename%>?page=<%=page+1%>><strong>>></strong></a>
      <a href=<%=filename%>?page=<%=rs.pagecount%>><strong>>>|</strong></a>
	  <%end if%>
	  <input name="chkall" type="checkbox" id="chkall" value="select" onClick="CheckAll(this.form)" style="border:0">全选
	  <input type=submit name=action value="删除" style="font-size: 9pt;  color: #000000; background-color: #EAEAF4; solid #EAEAF4" >
	  </td>
<%end if%>
</form>
</tr> 
</table>
<%
	Call footer()
end Sub

sub config()
	Call header()
	Set rsinfo=conn.execute("select * from ameav_config")
	N_In		= rsinfo("N_In")
	Kill_IP		= rsinfo("Kill_IP")			
	WriteSql	= rsinfo("WriteSql")		
	alert_url	= rsinfo("alert_url")
	alert_info	= rsinfo("alert_info")
	kill_info	= rsinfo("kill_info")
	N_type		= rsinfo("N_type")
	Sec_Forms	= rsinfo("Sec_Forms")
	Sec_Form_open = rsinfo("Sec_Form_open")
	rsinfo.close
	Set rsinfo=Nothing 

%>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#6298E1">
	<form name="form" method="post" action="<%=url%>?action=saveconfig">
		<tr>
        <td  align="left" bgcolor="#EBF2F9">需要过滤的关键字：</td>
        <td bgcolor="#EBF2F9">&nbsp; <input name="N_In" type="text" value="<%=N_In%>" id="r_str" style=" " size="50">
        用&quot;|&quot;分开</td>
      </tr>
      <tr>
        <td bgcolor="#EBF2F9">是否记录入侵者信息：</td>
        <td bgcolor="#EBF2F9">&nbsp; <select name="WriteSql" id="r_kill">
          <option value="1" <%if WriteSql=1 Then response.write "selected"%>>是</option>
          <option value="0" <%if WriteSql=0 Then response.write "selected"%>>否</option>
        </select></td>
      </tr>
      <tr>
        <td bgcolor="#EBF2F9">是否启用锁定IP：</td>
        <td bgcolor="#EBF2F9">&nbsp; <select name="Kill_IP" id="r_kill">
          <option value="1" <%if Kill_IP=1 Then response.write "selected"%>>是</option>
          <option value="0" <%if Kill_IP=0 Then response.write "selected"%>>否</option>
        </select></td>
      </tr>
      <tr>
        <td bgcolor="#EBF2F9">是否启用安全页面：</td>
        <td bgcolor="#EBF2F9">&nbsp; <select name="Sec_Form_open" id="r_kill">
          <option value="1" <%if Sec_Form_open=1 Then response.write "selected"%>>是</option>
          <option value="0" <%if Sec_Form_open=0 Then response.write "selected"%>>否</option>
        </select>
		慎用这个功能，除非你对确认此页面无需过滤，并确定对安全没影响！
		</td>
      </tr>
	  <tr>
        <td bgcolor="#EBF2F9">您认为安全的页面：</td>
        <td bgcolor="#EBF2F9">&nbsp; <input name="Sec_Forms" type="text" value="<%=Sec_Forms%>" id="r_str" style=" " size="50">
        用&quot;|&quot;分开</td>
      </tr>
      <tr>
        <td bgcolor="#EBF2F9">出错后的处理方式：</td>
        <td bgcolor="#EBF2F9">&nbsp; <select name="N_type" id="r_kill">
          <option value="1" <%if N_type=1 Then response.write "selected"%>>直接关闭网页</option>
          <option value="2" <%if N_type=2 Then response.write "selected"%>>警告后关闭</option>
		  <option value="3" <%if N_type=3 Then response.write "selected"%>>跳转到指定页面</option>
		  <option value="4" <%if N_type=4 Then response.write "selected"%>>警告后跳转</option>
        </select></td>
      </tr>
	<tr>
        <td bgcolor="#EBF2F9">出错后跳转Url：</td>
        <td bgcolor="#EBF2F9">&nbsp; <input name="alert_url" type="text" value="<%=alert_url%>" id="r_str" style=" " size="30">注意，这里的都是半角符号，就是英文的！
	  </td>
      </tr>
      <tr>
        <td bgcolor="#EBF2F9">警告提示信息：</td>
        <td bgcolor="#EBF2F9">&nbsp; <textarea name="alert_info" cols="45" rows="4" id="r_err2" style=";  "><%=alert_info%></textarea>\n\n换行，
		</td>
      </tr>
	  <tr>
        <td bgcolor="#EBF2F9">阻止访问提示信息：</td>
        <td bgcolor="#EBF2F9">&nbsp; <textarea name="kill_info" cols="45" rows="4" id="r_err2" style=";  "><%=kill_info%></textarea>\n\n换行
		</td>
      </tr>
      <tr>
        <td colspan="2" bgcolor="#EBF2F9"><div align="center">
          <input name="enter_3" type="submit" id="enter_3" value="提交">
        </div></td>
      </tr>
  </form>
</table>
<%
	Call footer()
	end Sub

Sub header()

%>

<title>Sql防注入系统</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style type="text/css">
<!--

table {
	font: 14px Tahoma, Verdana, "宋体";
}
a:link, a:visited {
	text-decoration: none;
	color: #036;
	font-family: Tahoma, Verdana, "宋体";
}
a:hover {
	text-decoration: none;
	color: #F90;
	font-family: Tahoma, Verdana, "宋体";
}
body {
	font-size: 9pt;

}
-->
</style>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#6298E1">
  <tr>
    <td height="24" nowrap><font color="#FFFFFF"><img src="Images/Explain.gif" width="18" height="18" border="0" align="absmiddle">&nbsp;<strong>防注入记录：这里并不是说网站已经被注入过，只是显示的黑客试图注入的记录</strong></font></td>
  </tr>
  <tr>
    <td height="24" align="center" nowrap  bgcolor="#EBF2F9"><a href="?Action=config" onClick='changeAdminFlag("系统设置")'>系统设置</a><font color="#0000FF">&nbsp;|&nbsp;</font><a href="<%=URL%>" onClick='changeAdminFlag("查看注入信息")'>查看注入信息</a></td>    
  </tr>
</table>
<%

	End Sub 
	sub footer()

end Sub
Sub Delip()
dim id 
id = request.form("id")
conn.execute("delete from ameav_SqlIn where id in ( " & id & ")")
Response.Redirect URL
End sub

Sub Lockip()
id = clng(request("id"))
conn.execute("update ameav_SqlIn set Kill_ip=true where id="&id)
Response.Redirect URL
End sub

Sub UnLockip()
id = clng(request("id"))
conn.execute("update ameav_SqlIn set Kill_ip=False where id="&id)
Response.Redirect URL
End sub
Sub saveconfig
	N_In		=replace(request.form("N_In"),"'","''")
	Kill_IP		=request.form("Kill_IP")			
	WriteSql	=request.form("WriteSql")		
	alert_url	=request.form("alert_url")
	alert_info	=request.form("alert_info")
	kill_info	=request.form("kill_info")
	N_type		=request.form("N_type")
	Sec_Forms	=request.form("Sec_Forms")
	Sec_Form_open=request.form("Sec_Form_open")

	sql="update ameav_config set N_In='"&N_In&"',Kill_IP="&Kill_IP&",WriteSql="&WriteSql&",alert_url='"&alert_url&"',alert_info='"&alert_info&"',kill_info='"&kill_info&"',N_type="&N_type&",Sec_Forms='"&Sec_Forms&"',Sec_Form_open="&Sec_Form_open&""
	'response.write sql
	conn.execute(sql)
	Application.Lock
	set Application("Neeao_config_info")=nothing
	Application.unlock
	Call main()
End Sub 

Function N_Replace(N_urlString)
	N_urlString = Replace(N_urlString,"'","''")
    N_urlString = Replace(N_urlString, ">", "&gt;")
    N_urlString = Replace(N_urlString, "<", "&lt;")
    N_Replace = N_urlString
End Function
%>
</body>
</html>