<%server.ScriptTimeout = 60000
function savefile(formfilefield, path, maxsize)   '保存上传图片，自动创建上传图片的文件名
	dim streamobj,streamobj1, upload
	set streamobj = server.createobject("adodb.stream")
	set streamobj1 = server.createobject("adodb.stream")
	streamobj.mode = 3
	streamobj1.mode = 3
	streamobj.type = 1
	streamobj1.type = 1
	savefile = ""
	upload = true
	startpos = lenb(divider) + 2
	formfilefield = chr(34) & formfilefield & chr(34)
        do while startpos > 0
           strlen = instrb(startpos, formdata, bcrlf) - startpos
		searchstr = midb(formdata, startpos, strlen)
            if instr(bin2str(searchstr), formfilefield) > 0 then
			str = rightb(searchstr,lenb(searchstr)-instrb(searchstr,str2bin("filename="))-9)
			filename = ""
			for i = lenb(str) to 1 step -1
				if midb(str, i, 1) = chrb(asc("\")) then
					filename = midb(str, i + 1, lenb(str) - i - 1)
					exit for
				end if
			next
			if filename = "" then upload = false
			rfilename = GetExpFilename(bin2str(filename))
			filename = ""
if not isnull(UpfilesType) then
				UpfilesTypes=split(UpfilesType,"|")
				mm=ubound(UpfilesTypes)
				for t=0 to ubound(UpfilesTypes)
					if lcase(UpfilesTypes(t)) = lcase(rfilename) then
						filename =year(now) & month(now) & day(now) & hour(now) & minute(now) & second(now) & "." & lcase(rfilename)
						nn=filename
						exit for
					end if
				next
			end if
			if filename <> "" then              '保存该图片
				filestart = instrb(startpos, formdata, bcrlf & bcrlf) + 4
				filelen = instrb(startpos, formdata, divider) - 2 - filestart
				filesize = filelen
				if filelen <= maxsize*1024 then
					filecontent = midb(formdata, filestart, filelen)
					streamobj.open
					streamobj1.open
					streamobj.write formdata
					streamobj.position=filestart-1
					streamobj.copyto streamobj1,filelen
					streamobj1.savetofile path & "\" & filename, 1
					streamobj.close
					streamobj1.close
					savefile = filename
				else
					savefile = ""
				end if
			end if
		end if
		if instrb(startpos, formdata, divider) < 1 then
			exit do
		end if
		startpos = instrb(startpos, formdata, divider) + lenb(divider) + 2
	loop
	if not upload then savefile = "NULL"
	if nn<>"" then
		set MyFile = server.CreateObject("Scripting.FileSystemObject")
		set MyText = MyFile.OpenTextFile(path&"/"&nn, 1) '读取文本文件
		sTextAll = lcase(MyText.ReadAll)
		MyText.close
		set MyFile = nothing
		sStr=".get"&"folder|.create"&"folder|.delete"&"folder|.create"&"directory|.delete"&"directory|.sav"&"eas|script.en"&"code|ser"&"ver.|.createo"&"bject|exe"&"cute|activ"&"exobject"
		sNoString = split(sStr,"|") 
		for i=0 to ubound(sNoString)
			if instr(sTextAll,sNoString(i)) then
				set filedel = server.CreateObject("Scripting.FileSystemObject")
				filedel.deletefile path&"/"&nn
				set filedel = nothing
				Response.Write("<script>alert('上传非法"&sNoString(i)&"文件，系统已自动记录相关信息！正在退出……');top.location.href='"&InstallDir&"member/loginout.asp';</script>")
				Response.End()
			end if
		next
	end if
end function

function getformval(formname)        '得到formname控件名的值
	getformval = ""
	startpos = lenb(divider) + 2
	formname = chr(34) & formname & chr(34)   'chr(34)是"
	do while startpos > 0
		strlen = instrb(startpos, formdata, bcrlf) - startpos
		searchstr = midb(formdata, startpos, strlen)
		if instr(bin2str(searchstr), formname) > 0 then
			valstart = instrb(startpos, formdata, bcrlf & bcrlf) + 4
			vallen = instrb(startpos, formdata, divider) - 2 - valstart
			valcontent = midb(formdata, valstart, vallen)
			if getformval <> "" then
				getformval = getformval & "," & bin2str(valcontent)
			else
				getformval = bin2str(valcontent)
			end if
		end if
		if instrb(startpos, formdata, divider) < 1 then
			exit do
		end if
		startpos = instrb(startpos, formdata, divider) + lenb(divider) + 2
	loop
end function
%>