应该说没有什么问题,就是一个与access数据库连接的ASP文件,不过其调用的sqlcheck.asp文件,可能与config.asp有点关系。
我把sqlcheck.asp文件加载一下,因为有人认为config.asp与conn.asp有关,而实际上conn.asp与sqlcheck.asp 是有关的,我现在的目的还是要搞清楚,config.asp字符的原形是什么?请教各位。
<% '防止Sql注入
On Error Resume Next
Fy_Url=Request.ServerVariables("QUERY_STRING")
Fy_a=split(Fy_Url,"&")
redim Fy_Cs(ubound(Fy_a))
On Error Resume Next
for Fy_x=0 to ubound(Fy_a)
Fy_Cs(Fy_x) = left(Fy_a(Fy_x),instr(Fy_a(Fy_x),"=")-1)
Next
For Fy_x=0 to ubound(Fy_Cs)
If Fy_Cs(Fy_x)<>"" Then
If Instr(LCase(Request(Fy_Cs(Fy_x))),"'")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"and")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"select")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"update")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"chr")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"delete%20from")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),";")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"insert")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"mid")<>0 Or Instr(LCase(Request(Fy_Cs(Fy_x))),"master.")<>0 Then
response.Write "<script language='javascript'>alert('出现错误,请勿尝试类似操作!');history.go(-1);</script>"
Response.End
End If
End If
Next
#@~^RQEAAA==W!x^DkKxP7+ ^W9+c\xd4Kw#@#@&\x/4G24!Y{*@#@&WGMPr'8~YKPsn `\nUktGw*@#@&kW,:bN`7+ dtKwSkBFb@!@*J+J,Otx@#@&-nx{lkmc:r[v\nxk4Wa~rS8##R-xdtK2(EO@#@&b0P7+ @*Fyv~Y4+U@#@&\+ x\xOOX@#@&Vk+r0~-x@!&y~Y4+U@#@&\+Ux7+U_OX@#@&n N,k0@#@&7nxm'-+ l'^4D`7nx*@#@&sd+@#@&7+Ulx-xC[14DvFfb@#@&+U[,kW@#@&U6O@#@&7+x1W9n'7+Ul@#@&nU9P0!UmDkW W10AAA==^#~@
%>