编辑器/阅读器

开发平台：
C#

searchfunction_xml.asp：源码内容
							<%
Function SearchSelectCate(cateid1,cateid2,Action)
If Action="SaveEditSetting" then
	If cstr(cateid1)=cstr(cateid2) then
	SearchSelectCate="selected"
	else
    SearchSelectCate=""
	End if
Else
SearchSelectCate=""
End if
End Function
Function SearchSelectChecked(radio1,radio2,Action)
If Action="SaveEditSetting" then
	If cstr(radio1)=cstr(radio2) then
	SearchSelectChecked="checked=""checked"""
	else
    SearchSelectChecked=""
	End if
Else
SearchSelectChecked=""
End if
End Function
Function CheckNumeric(Byval CHECK_ID)
		If CHECK_ID<>"" and IsNumeric(CHECK_ID) Then _
			CHECK_ID = cCur(CHECK_ID) _
		Else _
			CHECK_ID = 0
		CheckNumeric = CHECK_ID
End Function
%>
<%
Sub SearchTable(searchtype,Action)
%>
<tr>
<td height="26">标题包含</td>
<td colspan=5><input name="s_title" type=text id="s_title" size=45 value=""</td>
</tr>
<tr>
<td height="28">分类为</td>
<td colspan=5>
<select name="s_cate" size=1 id="s_cate">
<option value=0 selected>任意</option>
<%
Set conn=ConnectDB()
set RS=conn.execute("SELECT * FROM [Category]")
WHILE NOT RS.EOF%>
<option value="<%=RS("Category_ID")%>"><%=RS("Category_Name")%></option>
<%
RS.MOVENEXT
WEND
RS.CLOSE
SET RS=NOTHING
closedb(conn)
%>
</select>
</td>
</tr>
<tr>
  <td rowspan="3">更新时间</td>
  <td height="22" colspan=5><input name="radiobutton" type="radio" value="1" checked="checked"/>
    任意</td>
</tr>
<tr>
  <td height="26" colspan=5><input name="radiobutton" type="radio" value="2"/>
    没更新过的
	  </td>
</tr>
<tr>
  <td height="26" colspan=5>
  <input name="radiobutton" type="radio" value="3"/>
    更新过的</td>
</tr>
<tr>
  <td rowspan="3">审核</td>
  <td height="22" colspan=5><input name="radiobutton1" type="radio" value="1" checked="checked"/>
    任意</td>
</tr>
<tr>
  <td height="26" colspan=5><input name="radiobutton1" type="radio" value="2"/>
    没审核过的
	  </td>
</tr>
<tr>
  <td height="26" colspan=5>
  <input name="radiobutton1" type="radio" value="3"/>
    审核过的</td>
</tr>
<tr>
  <td rowspan="3">元素</td>
  <td height="22" colspan=5><input name="radiobutton2" type="radio" value="1" checked="checked"/>
    任意</td>
</tr>
<tr>
  <td height="26" colspan=5><input name="radiobutton2" type="radio" value="2"/>
    没设置过元素的
	  </td>
</tr>
<tr>
  <td height="26" colspan=5>
  <input name="radiobutton2" type="radio" value="3"/>
    设置过元素的</td>
</tr>
<tr>
<td height="34"><u>XML_URL包含:</u><br />
 feed地址(唯一标识)</td>
<td colspan=5><input name="s_url" type=text id="s_url" size=45 value=""></td>
</tr>
<tr>
<td height="26"><u>网站地址(site)包含:</u><br />
  隶属于哪个总站<br /></td>
<td colspan=5><input name="s_site" type=text id="s_site" size=45 value=""></td>
</tr>
<tr>
  <td height="26">描述包含</td>
  <td colspan=5><input name="s_description" type=text id="s_description" size=45  value=""/></td>
</tr>
<tr>
  <td height="26">
  每页显示
  </td>
  <td colspan=5><input name="maxperpaage" type="text" id="maxperpaage" size="20"  value=""/>
条</td>
</tr>
<%
End Sub
Public NewsSql
Sub SearchRequestAction
    If validate_string(Lcase(Request.QueryString))=False then
	response.write "Don't try to hack."
	Response.end
	End If
    Sqlstr=""
	If trim(Request("s_title")) <> "" Then
	    s_title=CStr(Replace(Request("s_title"),chr(39),chr(39)&chr(39)))
		If Sqlstr = "" Then
			Sqlstr = " title LIKE '%" & s_title & "%'"
		Else
			Sqlstr = Sqlstr & " AND title LIKE '%" & s_title & "%'"
		End If
	End If
	If request("radiobutton")<>1 then
        If request("radiobutton")=2 then
			If Sqlstr = "" Then
				Sqlstr = " isnull(lastupdatetime) "
			Else
				Sqlstr = Sqlstr & " AND  isnull(lastupdatetime) "
			End If
		End If
		If request("radiobutton")=3 then
			If Sqlstr = "" Then
				Sqlstr = " not isnull(lastupdatetime) "
			Else
				Sqlstr = Sqlstr & " AND  not isnull(lastupdatetime) "
			End If
		End If
	End if
	If request("radiobutton1")<>1 then
        If request("radiobutton1")=2 then
			If Sqlstr = "" Then
				Sqlstr = " ShenHe=0 "
			Else
				Sqlstr = Sqlstr & " AND  ShenHe=0 "
			End If
		End If
		If request("radiobutton1")=3 then
			If Sqlstr = "" Then
				Sqlstr = " ShenHe=1 "
			Else
				Sqlstr = Sqlstr & " AND  ShenHe=1 "
			End If
		End If
	End if
	If request("radiobutton2")<>1 then
        If request("radiobutton2")=2 then
			If Sqlstr = "" Then
				Sqlstr = " Elements='' "
			Else
				Sqlstr = Sqlstr & " AND  Elements='' "
			End If
		End If
		If request("radiobutton2")=3 then
			If Sqlstr = "" Then
				Sqlstr = " Elements<>'' "
			Else
				Sqlstr = Sqlstr & " AND  Elements<>'' "
			End If
		End If
	End if
	'更新时间审核元素
	If trim(URLDecode(Request("s_url"))) <> "" Then
    s_url=CStr(Replace(URLDecode(Request("s_url")),chr(39),chr(39)&chr(39)))
		If Sqlstr = "" Then
			Sqlstr = " linkxml LIKE '%" & s_url & "%'"
		Else
			Sqlstr = Sqlstr & " AND linkxml LIKE '%" & s_url & "%'"
		End If
	End If
	If trim(URLDecode(Request("s_site"))) <> "" Then
	s_site=CStr(Replace(URLDecode(Request("s_site")),chr(39),chr(39)&chr(39)))
		If Sqlstr = "" Then
			Sqlstr = " htmlUrl LIKE '%" & s_site & "%'"
		Else
			Sqlstr = Sqlstr & " AND htmlUrl LIKE '%" & s_site & "%'"
		End If
	End If
	If trim(Request("s_description")) <> "" Then
	s_description=CStr(Replace(Request("s_description"),chr(39),chr(39)&chr(39)))
		If Sqlstr = "" Then
			Sqlstr = " Description LIKE '%" & URLDecode(s_description) & "%'"
		Else
			Sqlstr = Sqlstr & " AND Description LIKE '%" & URLDecode(s_description) & "%'"
		End If
	End If
	If isempty(Request("s_cate")) then 
	s_cate=0
	else
       If trim(Request("s_cate"))="" then
        s_cate=0
       else
	    s_cate=Request("s_cate")
	   end if
   	end if
    call CheckParameter(s_cate,"int",0)
	If s_cate<>0 Then
		If Sqlstr = "" Then
			Sqlstr = " LinkXML.Category_id =" & s_cate & " "
		Else
			Sqlstr = Sqlstr & " AND LinkXML.Category_id =" & s_cate & " "
		End If
	End If
	If trim(request("shenhesql"))<>"" then
		if Sqlstr<>"" then
		conn.execute ("update [linkxml] set [shenhe]=1 where " & Sqlstr &" ")
		response.write "通过审核成功"
		response.end
		else
		conn.execute("update [linkxml] set [shenhe]=1")
		response.write "通过审核成功"
		response.end
		end if
	elseif trim(request("NotShenHeSql"))<>"" then
	    if Sqlstr<>"" then
		conn.execute ("update [linkxml] set [shenhe]=0 where " & Sqlstr &" ")
		response.write "不通过审核成功"
		response.end
		else
		conn.execute("update [linkxml] set [shenhe]=0")
		response.write "不通过审核成功"
		response.end
		end if
	elseif trim(request("ViewSql"))<>"" then
	    
	    if Sqlstr<>"" then
		conn.execute ("update [linkxml] set [other]='Y' where " & Sqlstr &" ")
		response.write "显示成功"
		Application.Lock
		Application(SessionStr&"SXNAindex")=empty
        Application(SessionStr&"SXNAintPageCount")=empty
		Application.unlock
		response.end
		else
		conn.execute("update [linkxml] set [other]='Y'")
		response.write "显示成功"
		Application.Lock
		Application(SessionStr&"SXNAindex")=empty
        Application(SessionStr&"SXNAintPageCount")=empty
		Application.unlock
		response.end
		end if
	elseif trim(request("NotViewSql"))<>"" then
	    if Sqlstr<>"" then
		conn.execute ("update [linkxml] set [other]='N' where " & Sqlstr &" ")
		response.write "不显示成功"
				Application.Lock
		Application(SessionStr&"SXNAindex")=empty
        Application(SessionStr&"SXNAintPageCount")=empty
		Application.unlock
		response.end
		else
		conn.execute("update [linkxml] set [other]='N'")
		response.write "不显示成功"
				Application.Lock
		Application(SessionStr&"SXNAindex")=empty
        Application(SessionStr&"SXNAintPageCount")=empty
		Application.unlock
		response.end
		end if
	Else
		if Sqlstr<>"" then
		sql="SELECT * FROM [LinkXML] INNER JOIN [Category] ON LinkXML.Category_id = Category.Category_id WHERE " & Sqlstr & " order by Linkxml.Category_id desc"
		else
		sql="SELECT * FROM [LinkXML] INNER JOIN [Category] ON LinkXML.Category_id = Category.Category_id order by Linkxml.Category_id desc"
		end if
	End IF
	NewsSql = sql
End Sub
%>
<%
Function OutPutSearchValue(searchtype,default)
if searchtype=1 then
OutPutSearchValue=Node.getAttribute(default)
elseif searchtype=0 and default="maxperpaage" then
OutPutSearchValue="20"
end if
end Function
 Function URLDecode(enStr)
  dim deStr
  dim c,i,v
  deStr=""
  for i=1 to len(enStr)
  c=Mid(enStr,i,1)
  if c="%" then
  v=eval("&h"+Mid(enStr,i+1,2))
  if v<128 then
  deStr=deStr&chr(v)
  i=i+2
  else
  if isvalidhex(mid(enstr,i,3)) then
  if isvalidhex(mid(enstr,i+3,3)) then
  v=eval("&h"+Mid(enStr,i+1,2)+Mid(enStr,i+4,2))
  deStr=deStr&chr(v)
  i=i+5
  else
  v=eval("&h"+Mid(enStr,i+1,2)+cstr(hex(asc(Mid(enStr,i+3,1)))))
  deStr=deStr&chr(v)
  i=i+3 
  end if 
  else 
  destr=destr&c
  end if
  end if
  else
  if c="+" then
  deStr=deStr&" "
  else
  deStr=deStr&c
  end if
  end if
  next
  URLDecode=deStr
  end function
  function isvalidhex(str)
  isvalidhex=true
  str=ucase(str)
  if len(str)<>3 then isvalidhex=false:exit function
  if left(str,1)<>"%" then isvalidhex=false:exit function
  c=mid(str,2,1)
  if not (((c>="0") and (c<="9")) or ((c>="A") and (c<="Z"))) then isvalidhex=false:exit function
  c=mid(str,3,1)
  if not (((c>="0") and (c<="9")) or ((c>="A") and (c<="Z"))) then isvalidhex=false:exit function
  end function
function validate_string(input) 
known_bad=array("select","insert","update","delete","drop","—","'",";","#") 
validate_string=true 
for i=lbound(known_bad) to ubound(known_bad) 
if(instr(1,input,known_bad(i),vbtextcompare)<>0) then 
validate_string=false 
exit function 
end if 
next 
end function 
%>

						