<%@ LANGUAGE = VBScript CodePage = 936%>
<%
Option Explicit
Response.Buffer = True
Dim Dataname,Startime,Conn,Db
Dim SqlString
Dim ConnStr
Startime = Timer()
Const IsSqlDataBase = 0 '定义数据库类别，1为SQL数据库，0为Access数据库
Call OpenConn()
On Error Resume Next
Sub OpenConn()
	On Error Resume Next
	Db = "Data/#888llee666777e8data#&%$#.asp" '数据库目录和名称,请使用绝对路径.
	SqlString = "Now()"
	ConnStr = "Provider = Microsoft.Jet.OLEDB.4.0;Data Source = " & Server.MapPath(Db)
	Set conn = Server.CreateObject("ADODB.Connection")
	conn.open ConnStr
	If Err Then
		err.Clear
		Set Conn = Nothing
        response.redirect"zhidao/"
		Response.End
	End If
End Sub
'-----------------------------------------------------------------------------------------------------
Sub CloseConn()
	On Error Resume Next
	If IsObject(DownSys) Then
		Set DownSys = Nothing
	End If
	If IsObject(Conn) Then
		Conn.Close
		Set Conn = Nothing
	End If
End Sub
%>
<%
On Error Resume Next
Dim strTemp,hk
If Trim(Request.QueryString) <> "" Then strTemp =Trim(Request.QueryString)
If Trim(Request) <> "" Then strTemp =Trim(Request)
If Request <> "" Then strTemp =Request
strTemp = LCase(strTemp)
hk=0
If Instr(strTemp,"%")<>0 then hk=1
If Instr(strTemp,"count(")<>0 then hk=1
If Instr(strTemp,"asc(")<>0 then hk=1
If Instr(strTemp,"mid(")<>0 then hk=1
If Instr(strTemp,"char(")<>0 then hk=1
If Instr(strTemp,"xp_cmdshell")<>0 then hk=1
If Instr(strTemp,"'")<>0 then hk=1
If Instr(strTemp,"select")<>0 then hk=1
If Instr(strTemp,"insert")<>0 then hk=1
If Instr(strTemp,"delete")<>0 then hk=1
If Instr(strTemp,"update")<>0 then hk=1
If Instr(strTemp,"and")<>0 then hk=1
If Instr(strTemp,"or")<>0 then hk=1
If Instr(strTemp,";")<>0 then hk=1
if hk=1 then
Response.Write "<script language='javascript'>"
Response.Write "alert('提交字符中包含非法字符,您的上网资料已被我们记录！');"
Response.Write "location.href='javascript:history.back()';"
Response.Write "</script>"
response.end
hk=0
End If
%></body></html>