<!--#include file=CONN.ASP-->
<!--#include file=foxx.asp-->
<!--#include file=md5.asp-->
<!--#include file="config.asp"-->
<%dim server_v1,server_v2
server_v1=Cstr(Request.ServerVariables("HTTP_REFERER"))
server_v2=Cstr(Request.ServerVariables("SERVER_NAME"))
if mid(server_v1,8,len(server_v2))<>server_v2 then
response.write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=450>"
response.write "<tr><td style=font:9pt Verdana>"
response.write "<center>你提交的路径有误，禁止从站点外部提交数据!</center>"
response.write "</td></tr></table></center>"
response.end
end if
%>
<%dim fqys,errc,i
fqys=request.servervariables("query_string") 
dim nothis(18) 
nothis(0)="net user" 
nothis(1)="xp_cmdshell" 
nothis(2)="/add" 
nothis(3)="exec%20master.dbo.xp_cmdshell" 
nothis(4)="net localgroup administrators" 
nothis(5)="select" 
nothis(6)="count" 
nothis(7)="asc" 
nothis(8)="char" 
nothis(9)="mid" 
nothis(10)="'" 
nothis(11)=":" 
nothis(12)="""" 
nothis(13)="insert" 
nothis(14)="delete" 
nothis(15)="drop" 
nothis(16)="truncate" 
nothis(17)="from" 
nothis(18)="%" 
errc=false 
for i= 0 to ubound(nothis) 
if instr(fqys,nothis(i))<>0 then 
errc=true 
end if 
next 
if errc then 
response.write "<script language=""javascript"">" 
response.write "parent.alert('非法操作!禁止攻击站点服务器!');" 
response.write "self.location.href='Index.Asp';" 
response.write "</script>" 
response.end 
end if 
%>
<%
dim username,password,rs,sql,k
if request.cookies("fox")("errs")="" then
k=0
else
k=request.cookies("fox")("errs")
end if
if request.cookies("fox")("errs")>10 then
response.write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=450>"
response.write "<tr><td style=font:9pt Verdana>"
response.write "<center>错误太多！系统停止对你审核！请联系站长．</center>"
response.write "</td></tr></table></center>"
response.end
end if
username=replace(trim(request("username")),"'","‘")
password=md5(request("password"))
chkfox(username)
if nothaveChinese(username)=false then
response.write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=450>"
response.write "<tr><td style=font:9pt Verdana>"
response.write "<center>不能使用中文名字！</center>"
response.write "</td></tr></table></center>"
end if
set rs=server.createobject("adodb.recordset")
sql="select * from [FOX_user] where UserName='"&UserName&"' and password='"&password&"'"
rs.open sql,conn,1,3
if rs.eof then
Response.cookies("fox")("errs")=k+1
response.write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=450>"
response.write "<tr><td style=font:9pt Verdana>"
response.write "<center>您提交的用户名或者密码错误！</center>"
response.write "</td></tr></table></center>"
response.end
else
rs("dlcs")=rs("dlcs")+1
rs("jf")=rs("jf")+dlf
rs.update
Response.cookies("fox")("username")=rs("username")
Response.cookies("fox")("domain")=Request.ServerVariables("SERVER_NAME")
Response.cookies("fox")("id")=rs("id")
end if
rs.close
set rs=nothing
closedb
Response.Redirect "userhome.asp"
%></body></html>