<%
 dim UserAgent
UserAgent=Trim(lcase(Request.Servervariables("HTTP_USER_AGENT")))
If Instr(UserAgent,"teleport")>0 or Instr(UserAgent,"netant")>0 or Instr(UserAgent,"flashget")>0 or Instr(UserAgent,"webzip")>0 or Instr(UserAgent,"offline")>0 or Instr(UserAgent,"googlebot")>0 or Instr(UserAgent,"frontpage")>0 Then
response.redirect "http://www.0hao.cn"
response.end
end if

dim conn,connstr,UserIP
   on error resume next
   connstr="DBQ="+server.mappath("datatbase/#music.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
   set conn=server.createobject("ADODB.CONNECTION")
   conn.open connstr    
sub CloseConn()
	conn.close
	set conn=nothing
end sub
If Err Then
		err.Clear
		Set Conn = Nothing
		Response.Write "Sorry! 数据库连接出错，请检查连接字串。"
		Response.End
End If

set rs=server.createobject("adodb.recordset")
UserIP=Request.ServerVariables("REMOTE_ADDR")
if Request.ServerVariables("HTTP_X_FORWARDED_FOR")<>"" then
    UserIP=Request.ServerVariables("HTTP_X_FORWARDED_FOR")  
end if
dim singertj
set rs=conn.Execute("select count(*) from [Sqlin] where SqlIn_IP='"&UserIP&"'")
times=rs(0)
rs.close
set rs=nothing

set rsy=server.createobject("adodb.recordset")
sql="select * from killip"
rsy.open sql,conn,1,1
ijip=0
if not rsy.EOF then
do while not rsy.eof
ijip=ijip+1
if rsy("ip")=UserIP then
rsy.Close
set rsy=nothing
conn.close
set conn=nothing
Response.write "您的IP已经被管理员限制不能访问本系统，请和管理员联系。"
Response.End
exit do
end if
rsy.MoveNext
loop
end if
rsy.Close

if times>2 then
set rs=server.createobject("adodb.recordset")
sql="select * from killip"
rs.open sql,conn,3,3
rs.addnew
rs("ip")=UserIP
rs.update
rs.Close
set rs=nothing
conn.close
set conn=nothing
Response.write "您的IP已经被管理员限制不能访问本系统，请和管理员联系。"
Response.End
end if
%>
<%
Dim Fy_Post,Fy_Get,Fy_In,Fy_Inf,Fy_Xh,Fy_db,Fy_dbstr
Fy_In = "'|;| and |exec | insert | select | delete | or | update | * |+|char|declare|>|<|=|""|count"
'----------------------------------"
'----------------------------------
%>

<%
Fy_Inf = split(Fy_In,"|")
'--------POST部份------------------
If Request.Form<>"" Then
For Each Fy_Post In Request.Form

For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh))<>0 Then
'--------写入数据库----------头-----
conn.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FURL,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','"&request.servervariables("HTTP_REFERER")&"','POST','"&Fy_Post&"','"&replace(Request.Form(Fy_Post),"'","''")&"')")
conn.close
Set conn = Nothing
'--------写入数据库----------尾-----

Response.Write "<Script Language=JavaScript>alert('SQL防注入系统提示↓\n\n请不要在参数中包含非法字符尝试注入！\n\n 操作将全部被记录到数据库！');</Script>"
Response.Write "非法操作！系统做了如下记录↓<br>"
Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：ＰＯＳＴ<br>"
Response.Write "提交参数："&Fy_Post&"<br>"
Response.Write "提交数据："&Request.Form(Fy_Post)
Response.End
End If
Next

Next
End If
'----------------------------------

'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString

For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
'--------写入数据库----------头-----
conn.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FURL,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','"&request.servervariables("HTTP_REFERER")&"','GET','"&Fy_Get&"','"&replace(Request.QueryString(Fy_Get),"'","''")&"')")
conn.close
Set conn = Nothing
'--------写入数据库----------尾-----

Response.Write "<Script Language=JavaScript>alert('SQL防注入系统提示↓\n\n请不要在参数中包含非法字符尝试注入！\n\n 操作将全部被记录到数据库！');</Script>"
Response.Write "非法操作！系统做了如下记录↓<br>"
Response.Write "操作ＩＰ："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：ＧＥＴ<br>"
Response.Write "提交参数："&Fy_Get&"<br>"
Response.Write "提交数据："&Request.QueryString(Fy_Get)
Response.End
End If
Next
Next
End If
%>
<%
title=trim(request.form("title"))
url=trim(request.form("url"))
pic=trim(request.form("pic"))
if title="" then
response.write"请填写网站名称!!<a href=""javascript:history.go(-1)"">返回重输</a>"
response.end
end if
if url="" then
response.write"请填写您的网址!!<a href=""javascript:history.go(-1)"">返回重输</a>"
response.end
end if
if pic="" then
response.write"请填写网站网站LOGO!!<a href=""javascript:history.go(-1)"">返回重输</a>"
response.end
end if
%>
<HTML>
<HEAD>
<TITLE>福建音乐视听网|友情链接|处理结果</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=gb2312">
<link href="images/css.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--
.style3 {color: #FF0000}
-->
</style>
</HEAD>
<BODY LEFTMARGIN=0 TOPMARGIN=0 MARGINWIDTH=0 MARGINHEIGHT=0>
      <table width="88%"  border="0" cellspacing="0" cellpadding="0">
        <tr>
          <th height="25" align="left" scope="row"><a href="index.asp">首页</a> &gt;&gt;&gt; <a href="link.asp">友情链接</a> &gt;&gt;&gt; 处理结果 </th>
        </tr>
      </table>
      <br>
      <table width="80%"  border="0" cellspacing="0" cellpadding="0">
        <tr>
          <td align="center" scope="row">
            <p>
              <%
set rs=server.createobject("adodb.recordset")
sql="select * from link"
rs.open sql,conn,3,3
rs.addnew
rs("title")=title
rs("url")=url
rs("pic")=pic
rs("dateandtime")=now()
rs("ip")=Request("REMOTE_ADDR")
rs.update
rs.close
set rs=nothing
call closeconn()
  %> 
              <br>
              <br>
            友情链接申请成功，我们会在24小时内审核！<br>
            <br>
            请在贵站也做上本站相应链接！</p>
          <p>&nbsp;链接代码：</p>
          <p>&lt;a href=&quot;http://www.0hao.cn/&quot;&gt;&lt;img src=&quot;http://www.0hao.cn/img/logo.gif&quot; width=&quot;88&quot; height=&quot;31&quot; border=&quot;0&quot;&gt;&lt;/a&gt;</p></td>
        </tr>
      </table>