<!--#include file=CONN.ASP-->
<!--#include file=foxx.asp-->
<!--#include file="config.asp"-->
<%dim server_v1,server_v2
server_v1=Cstr(Request.ServerVariables("HTTP_REFERER"))
server_v2=Cstr(Request.ServerVariables("SERVER_NAME"))
if mid(server_v1,8,len(server_v2))<>server_v2 then
response.write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=450>"
response.write "<tr><td style=font:9pt Verdana>"
response.write "<center>你提交的路径有误，禁止从站点外部提交数据!</center>"
response.write "</td></tr></table></center>"
response.end
end if
%>
<%dim fqys,errc,i
fqys=request.servervariables("query_string") 
dim nothis(18) 
nothis(0)="net user" 
nothis(1)="xp_cmdshell" 
nothis(2)="/add" 
nothis(3)="exec%20master.dbo.xp_cmdshell" 
nothis(4)="net localgroup administrators" 
nothis(5)="select" 
nothis(6)="count" 
nothis(7)="asc" 
nothis(8)="char" 
nothis(9)="mid" 
nothis(10)="'" 
nothis(11)=":" 
nothis(12)="""" 
nothis(13)="insert" 
nothis(14)="delete" 
nothis(15)="drop" 
nothis(16)="truncate" 
nothis(17)="from" 
nothis(18)="%" 
errc=false 
for i= 0 to ubound(nothis) 
if instr(fqys,nothis(i))<>0 then 
errc=true 
end if 
next 
if errc then 
response.write "<script language=""javascript"">" 
response.write "parent.alert('非法操作!禁止攻击站点服务器!');" 
response.write "self.location.href='Index.Asp';" 
response.write "</script>" 
response.end 
end if 
%>
<%
dim xxid,ts,username,lxrname,usertel,phone,company,xinxipic,qq,email,dizhi,code,memo,huitype,yz,class1,class2,youxiao,b,leixing,jiage,sheng,shi,xiang,rs,sql,userip
xxid=trim(request("xxid"))
ts=trim(request("ts"))
xinxipic=trim(request("xinxipic"))
username=trim(request("username"))
lxrname=trim(request("lxrname"))
usertel=trim(request("usertel"))
phone=trim(request("phone"))
company=trim(request("company"))
qq=trim(request("qq"))
email=trim(request("email"))
dizhi=trim(request("dizhi"))
code=trim(request("code"))
memo=trim(request("memo"))
huitype=trim(request("huitype"))
yz=trim(request("yz"))
class1=trim(request("class1"))
class2=trim(request("class2"))
youxiao=trim(request("youxiao"))
b=trim(request("b"))
leixing=trim(request("leixing"))
jiage=trim(request("jiage"))
sheng=trim(request("sheng"))
shi=trim(request("shi"))
xiang=trim(request("xiang"))

set rs=server.createobject("adodb.recordset")
sql="select * from [FOX_xinxi] where UserName='"&UserName&"' and xxid='"&xxid&"'"
rs.open sql,conn,1,3
if session("addfreexinxi")<>"" then
  if DateDiff("s",session("addfreexinxi"),Now())<180 then
  response.write "<script>alert('系统保护：你提交数据太快，系统中止运行，请等待180秒钟！！');this.location.href='userhome.asp';</SCRIPT>"
  response.end
  end if
  end if
if not rs.eof or not rs.bof then
rs("ts")=ts
rs("lxrname")=lxrname
rs("usertel")=usertel
rs("phone")=phone
rs("company")=company
rs("qq")=qq
rs("email")=email
rs("dizhi")=dizhi
rs("code")=code
rs("memo")=memo
rs("huitype")=huitype
rs("class1")=class1
rs("class2")=class2
rs("leixing")=leixing
rs("jiage")=jiage
rs("sheng")=sheng
rs("shi")=shi
rs("xiang")=xiang
rs("youxiao")=youxiao
if request("b")="" then
rs("b")=0
else
rs("b")=b
end if
if xinxipic<>"" then
rs("xinxipic")=xinxipic
end if
if huitype>"0" and yz="1" then
rs("yz")=1
else
rs("yz")=0
end if
rs("fbsj")=now()
rs("dqsj")=rs("fbsj")+rs("youxiao")
userip=Request.ServerVariables("HTTP_X_FORWARDED_FOR")
If userip="" Then 
userip=Request.ServerVariables("REMOTE_ADDR")
end if
rs("ip")=userip
rs.update
rs.close
set rs=nothing
else
rs.addnew
rs("xxid")=xxid
rs("ts")=ts
rs("username")=username
rs("lxrname")=lxrname
rs("usertel")=usertel
rs("phone")=phone
rs("company")=company
rs("qq")=qq
rs("email")=email
rs("dizhi")=dizhi
rs("code")=code
rs("memo")=memo
rs("huitype")=huitype
rs("class1")=class1
rs("class2")=class2
rs("youxiao")=youxiao
rs("leixing")=leixing
rs("jiage")=jiage
rs("sheng")=sheng
rs("shi")=shi
rs("xiang")=xiang
rs("youxiao")=youxiao
if request("b")="" then
rs("b")=0
else
rs("b")=b
end if
rs("huitype")=5
rs("yz")=0
rs("fbsj")=now()
rs("dqsj")=rs("fbsj")+rs("youxiao")
userip=Request.ServerVariables("HTTP_X_FORWARDED_FOR")
If userip="" Then 
userip=Request.ServerVariables("REMOTE_ADDR")
end if
rs("ip")=userip
rs.update
rs.close
set rs=nothing
end if
closedb
session("addfreexinxi")=now()
    Response.Write "<script>alert('发布成功！');this.location.href='addfreexinxi.asp';</SCRIPT>"
     response.end
Response.Redirect "xinxima.asp"
%></body></html>