<%
'正则表达式相关的变量
Dim regEx, Match, Match2, Matches, Matches2
Set regEx = New RegExp
'SQL防注入设置
Dim EnableStopInjection
EnableStopInjection = True

If EnableStopInjection = True Then
    If Request.QueryString <> "" Then Call StopInjection(Request.QueryString)
    If Request.Cookies <> "" Then Call StopInjection(Request.Cookies)
	If Request.Form <> "" Then Call StopInjection2(Request.Form)
End If

Sub StopInjection(Values)
    On Error Resume Next
    Dim FoundInjection
    regEx.Pattern = "'|;|([\s\b+()]+(select|update|insert|delete|declare|@|exec|dbcc|alter|drop|create|backup|if|else|end|and|or|add|set|open|close|use|begin|retun|as|go|exists)[\s\b+]*)"
    Dim sItem, sValue
    'response.wirte Request.Cookies
    For Each sItem In Values
        sValue = Values(sItem)
        If regEx.Test(sValue) Then
            FoundInjection = True
            Call CleanCookies()
            Call QvodCms_Err_Url("您的操作产生了危险参数,致使本次操作无效！","../")
            Set Matches = regEx.Execute(sValue)
            For Each Match In Matches
            Response.Write Match.value & " "
            Next
            'Response.Write "<br><br>如果您是正常提交仍出现上面的提示，请修改Sql.asp文件的第7行，暂时禁用掉防SQL注入功能，操作完成后再打开。"
            
        End If
    Next
    If FoundInjection = True Then
        Response.End
    End If
End Sub

Sub StopInjection2(Values)
    Dim regEx
    Set regEx = New RegExp
    regEx.IgnoreCase = True
    regEx.Global = True
    regEx.Pattern = "[';#()][\s+()]*(select|update|insert|delete|declare|@|exec|dbcc|alter|drop|create|backup|if|else|end|and|or|add|set|open|close|use|begin|retun|as|go|exists)[\s+]*"
    Dim sItem, sValue
    For Each sItem In Values
        sValue = Values(sItem)
        If regEx.Test(sValue) Then
            Response.Write "很抱歉，由于您提交的内容中含有危险的SQL注入代码，致使本次操作无效！<br><br>如果您是正常提交仍出现上面的提示，请联系站长修改文件，暂时禁用掉防SQL注入功能，操作完成后再打开。"
            Response.End
        End If
    Next
    Set regEx = Nothing
End Sub

Function CleanCookies() 
DomainPath=Left(Request.ServerVariables("script_name"),inStrRev(Request.ServerVariables("script_name"),"/")) 
For Each objCookie In Request.Cookies 
Response.Cookies(objCookie)= "" 
Response.Cookies(objCookie).Path = DomainPath 
Next 
End Function 

%>