.net编程

开发平台：
Visual Basic

ocdb.asp：源码内容
							<%
dim conn   
dim connstr
connstr="DBQ="+server.mappath("addshujumulu.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
set conn=server.createobject("ADODB.CONNECTION")
conn.open connstr 
dim nowtime
nowtime=now()
sj=cstr(year(nowtime))+"年"+right("0"+cstr(month(nowtime)),2)+"月"+right("0"+cstr(day(nowtime)),2)+"日"
function checkstr(checkstr_s)
set strs=new regexp
strs.pattern="^[A-Za-z0-9]+$"
if strs.test(checkstr_s)=false then
response.write"<script>alert('对不起您没有登录或登录超时');window.location='index.asp'</script>"
response.end()
end if
checkstr=checkstr_s
end function
function logsys(xx)
set rs=server.createobject("adodb.recordset")
sql="select * from history"
rs.open sql,conn,1,3
rs.addnew
rs("hdate")=now()
rs("htext")=xx
rs("happly")=session("aname")
rs("address")=ips()
rs.update
rs.close
set rs=nothing
end function
function ips()
userip = Request.ServerVariables("HTTP_X_FORWARDED_FOR") 
If userip = "" Then userip = Request.ServerVariables("REMOTE_ADDR")
ips=userip
end function
function m_id(m_id_t)
set m_id_rs=conn.execute("select top 1 id from "&m_id_t&" order by id desc")
if m_id_rs.eof then
m_id=1
else
m_id=m_id_rs("id")+1
end if
m_id_rs.close
set m_id_rs=nothing
end function
dim fx,fstr
for each fx in request.QueryString()
fstr=request.QueryString(fx)
fstr=replace(fstr,"%27","‘")
if instr(fstr,"'")>0 or instr(fstr,"select ")>0 or instr(fstr,"net user")>0 or instr(fstr,"xp_cmdshell")>0 or instr(fstr,"/add")>0 or instr(fstr,"exec master.dbo.xp_cmdshell")>0 or instr(fstr,"net localgroup administrators")>0 or instr(fstr,"%")>0 or instr(fstr,"delete")>0 or Instr(fstr,"insert 20")>0 or Instr(fstr,"delete from")>0 or Instr(fstr,"count(")>0 or Instr(fstr,"drop table")>0 or Instr(fstr,"update ")>0 or Instr(fstr,"truncate ")>0 or Instr(fstr,"asc(")>0 or Instr(fstr,"mid(")>0 or Instr(fstr,"char(")>0 or Instr(fstr,":")>0 or Instr(fstr," or ")>0  or Instr(fstr," and ")>0then
response.Write("<script>alert('请不要输入特殊字符!');window.close()</script>")
response.End()
end if
next
for each fx in request.Form()
fstr=request.Form(fx)
fstr=replace(fstr,"%27","‘")
fstr=replace(fstr,"'","‘")
fstr=replace(fstr,"<","〈")
fstr=replace(fstr,">","〉")
if instr(fstr,"select%20")>0 or instr(fstr,"net%20user")>0 or instr(fstr,"xp_cmdshell")>0 or instr(fstr,"/add")>0 or instr(fstr,"exec%20master.dbo.xp_cmdshell")>0 or instr(fstr,"net%20localgroup%20administrators")>0 or instr(fstr,"delete")>0 or Instr(fstr,"insert%20")>0 or Instr(fstr,"delete%20from")>0 or Instr(fstr,"count(")>0 or Instr(fstr,"drop%20table")>0 or Instr(fstr,"update%20")>0 or Instr(fstr,"truncate%20")>0 or Instr(fstr,"asc(")>0 or Instr(fstr,"mid(")>0 or Instr(fstr,"char(")>0 or Instr(fstr,"%20or%20")>0  then
response.Write("<script>alert('请不要输入特殊字符!');window.close()</script>")
response.End()
end if
next
function isnumber(isnumber_id)
if isnumeric(isnumber_id)=true then
isnumber=isnumber_id
else
response.write "<script language=javascript>alert('请不要恶心访问本站');</script>请不要恶意访问本网站"
response.end
end if
end function
%>

						