<%
Call ChkRef()
Sub ChkRef()
dim str
'-------------------
str = ""
for each element in Request.QueryString
	str=str & Request.QueryString(element)
next 
'-------------------
if instr(1,str,"or",vbTextCompare)<>0 or InStr(str,"'")<>0 or InStr(str,",")<>0 or InStr(str,"=")<>0 or InStr(str,"%")<>0 or InStr(str,"&")<>0 or InStr(str,"|")<>0 or InStr(fn1,"^")<>0 or InStr(fn1,"(")<>0 then
	Call stopEx()
End If
End Sub
Sub stopEx()
Response.write "非法操作！请不要远程提交数据或在提交数据中包含or字符，引号，等号，逗号,%符号，|符号,^符号,&括号！"
Response.end
end sub
if nickname="" or grade=0 then
	message=message&"<li>你已经超时掉线，请重新<a href=../>登录</a><li>此用户名还未<a href=../>注册</a>"
	error(""&message&"")
end if
bbsname = request.querystring("bbsname")
b_menu = Request.querystring("menu")
Q_id = Request.querystring("id")
Q_forumid = Request.querystring("forumid")
if Q_id= "" then
	Q_id = Request.form("id")
	Q_forumid = Request.form("forumid")
end if
Q_moveid = Request.form("moveid")
Q_retopicid = Request.querystring("retopicid")
Set connj=Server.CreateObject("ADODB.CONNECTION")
Set rs2=Server.CreateObject("ADODB.RecordSet")
connstr2=Application("cwjh_usermdb")
connj.open connstr2
sql="select a from p where a='" & bbsname & "' and b='" & nickname & "'"
rs2.Open sql,connj,1,1
if not rs2.eof then pass=1
rs2.close
if grade = 10 then
pass=1
end if
if isnumeric(""&Q_forumid&"") = flase then
error("<li>非法操作")
end if
if Q_forumid <>"" then
sql="select moderated,bbsname from bbsconfig where id="&Request("forumid")&""
rs.Open sql,Conn,1
bbsname=rs(1)
if instr(rs(0),"|"&nickname&"|")>0 then
pass=1
end if
rs.close
end if
if pass<>1 then
error("<li>您的权限不够")
end if
%>