<%
Dim conn
dim qs,errc,iii
qs=request.servervariables("query_string")
dim nothis(18)
nothis(0)="net user"
nothis(1)="xp_cmdshell"
nothis(2)="/add"
nothis(3)="exec%20master.dbo.xp_cmdshell"
nothis(4)="net localgroup administrators"
nothis(5)="select"
nothis(6)="count"
nothis(7)="asc"
nothis(8)="char"
nothis(9)="mid"
nothis(10)="'"
nothis(11)=":"
nothis(12)=""""
nothis(13)="insert"
nothis(14)="delete"
nothis(15)="drop"
nothis(16)="truncate"
nothis(17)="from"
nothis(18)="and user>0"
errc=false
for iii= 0 to ubound(nothis)
if instr(qs,nothis(iii))<>0 then
errc=true
end if
next
if errc then
Response.Write("对不起，非法URL地址请求!")
response.end
end if

linkdb=1'1连接access,2连接sql server
db="../db/#data_bbs#.asp"
   
Set conn = Server.CreateObject("ADODB.Connection")
if linkdb=1 then
   ConnectionString = "Provider = Microsoft.Jet.OLEDB.4.0;Data Source = " & Server.MapPath(db)
   conn.Open ConnectionString 
else
   conn.Open "driver={sql server};server=;uid=sa;pwd=;database=bbs"
end if

Function FTBBS_HTML_MB()  '读取模板函数call FTBBS_HTML_MB,应用Application("FTBBSMB")(1,0)
    If vartype(Application("FTBBSMB"))=0 then
		sql="select top 1 * from ftbbsmb where id=1"
        Set rs = Server.CreateObject("ADODB.Recordset")
        rs.open sql,conn,1,1
        Application.Lock
        Application("FTBBSMB")=rs.GetRows(-1)
        Application.UnLock
        rs.Close
        set rs=nothing
    end if
End Function
Function FTBBS_BZ_NAME(BoardID_1)
       str="select BBS_Cate_ID,BBS_Cate_Name,BBS_Cate_Manager_Name from BBS_CATE Where BBS_Cate_PID='0' and BBS_Cate_ID='"&BoardID_1&"' order by BBS_ID asc"
       Set rs = Server.CreateObject("ADODB.Recordset")
       rs.open str,conn,1,1
        Application.Lock
        Application("BBS_Cate_Name1")=rs("BBS_Cate_Name")
        Application.UnLock
       rs.close
       set rs=nothing
End Function
Function FTBBS_BZ_NAME2(BoardID_1,BoardID_2)
       sql="select BBS_Cate_ID,BBS_Cate_Name,BBS_Cate_Manager_Name from BBS_CATE Where BBS_Cate_PID='"&BoardID_1&"' and BBS_Cate_ID='"&BoardID_2&"' order by BBS_ID asc"
       Set rs = Server.CreateObject("ADODB.Recordset")
       rs.open sql,conn,1,1
        Application.Lock
        Application("BBS_Cate_Name2")=rs("BBS_Cate_Name")
		Application("BBS_Cate_Manager_Name")=rs("BBS_Cate_Manager_Name")
        Application.UnLock
       rs.close
       set rs=nothing
End Function
'图片名称
function makefilename(fname)
  fname = now()
  fname = replace(fname,"-","")
  fname = replace(fname," ","") 
  fname = replace(fname,":","")
  fname = replace(fname,"PM","")
  fname = replace(fname,"AM","")
  fname = replace(fname,"上午","")
  fname = replace(fname,"下午","")
  makefilename=fname
end function 
'图片后缀
function GetExtendName(FileName)
  dim ExtName
  ExtName = LCase(FileName)
  ExtName = right(ExtName,3)
  ExtName = right(ExtName,3-Instr(ExtName,"."))
  GetExtendName = ExtName
end function
'检查是否安装组件
Function IsObjInstalled(strClassString)
    On Error Resume Next
    IsObjInstalled = False
    Dim xTestObj
    Set xTestObj = Server.CreateObject(strClassString)
    If Err<>-2147221005 Then IsObjInstalled = True Else IsObjInstalled = False End IF
    Set xTestObj = Nothing
End Function
'论坛基本参数
function pickind(kind)
  Sql_kind="select * from config where kind="&kind&" order by id asc"
  set rskind=server.createobject("adodb.recordset")
  rskind.open Sql_kind,conn,1,1
  pickind=rskind("content")
  rskind.close
  set rskind=nothing
end function
Function FTBBS_CS()
    If vartype(Application("FTBBS_CS_1"))=0 or vartype(Application("FTBBS_CS_2"))=0 or vartype(Application("FTBBS_CS_3"))=0 or vartype(Application("FTBBS_CS_4"))=0 then
        url=pickind(1)
        if right(url,1)<>"/" then
           url=pickind(1)&"/"
        end if
        Application.Lock
        Application("FTBBS_CS_1")=url
		Application("FTBBS_CS_2")=pickind(2)
		Application("FTBBS_CS_3")=pickind(3)
		Application("FTBBS_CS_4")=pickind(4)
        Application.UnLock
	end if
End Function		
%>