网站又被挂了马！大家帮忙分析下代码哪里有问题？
让别人检查过 说是我的搜索页有问题 这个就是代码！可能是注入问题吧先谢谢大家了
<table width="682" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="13" height="10"><img src="imager/houbu/bk001.gif" width="13" height="10"></td>
<td height="10" background="imager/houbu/bk002.gif"></td>
<td width="13" height="10"><img src="imager/houbu/bk003.gif" width="13" height="10"></td>
</tr>
<tr>
<td width="13" background="imager/houbu/bk008.gif"> </td>
<td>
<table width="656" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
<table width="656" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="9" height="27"><img src="imager/houbu/0004c.gif" width="9" height="27"></td>
<td width="638" height="27" class="biaoge08">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="3%" align="left" valign="middle"><img src="imager/houbu/0004b.gif" width="4" height="12"></td>
<td width="77%" align="left" valign="middle">
<%if jiage="" then
if searchkey="" then
response.write "<script language=javascript>alert('对不起，请您输入查讯关键字');history.go(-1);</script>"
response.End
else
response.write " <span class=ziti08a>您查讯的关键字是：</span> "
if anclassid<>0 then
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from shop_anclass where anclassid="&anclassid,conn,1,1
response.write "<a class=ziti06 href=class_product.asp?lx=big&anid="&anclassid&"><font color=red>"&rs("anclass")&"</font></a>"&" >> "
rs.close
set rs=nothing
end if
response.write "<font color=red>"&searchkey&"</font>"
s_bookname=searchkey
end if
else
if (action="1" or action="3") and searchkey="" then
response.write "<script language=javascript>alert('对不起，请您输入查讯关键字');history.go(-1);</script>"
response.End
else
response.write "<span class=ziti08a> 您查讯的关键字是：</span> "
if anclassid<>0 then
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from shop_anclass where anclassid="&anclassid,conn,1,1
response.write "<a class=ziti06 href=class_product.asp?lx=big&anid="&anclassid&"><font color=red>"&rs("anclass")&"</font></a>"&" >> "
rs.close
set rs=nothing
end if
if action="1" or action="3" then
response.write "<span class=ziti08b><strong><font color=red>"&searchkey&"</font></strong></span>"
s_bookname=searchkey
else
response.write "<span class=ziti08b><strong><font color=red>"&selectname&"</font></strong></span>"
s_bookname=selectname
end if
end if
end if%>
</td>
<td width="6%" align="center" valign="middle"><img src="imager/houbu/0004a.gif" width="13" height="13"></td>
<td width="14%" align="left" valign="middle"> </td>
</tr>
</table>
</td>
<td width="9" height="27"><img src="imager/houbu/0004c1.gif" width="9" height="27"></td>
</tr>
</table>
</td>
</tr>
<tr>
<td height="10" class="ziti01">
<%
Const MaxPerPage=20
dim totalPut
dim CurrentPage
dim TotalPages
dim j
dim sql
if Not isempty(request("page")) then
currentPage=Cint(request("page"))
else
currentPage=1
end if
if jiage="" then '//普通查询
sql2="searchkey="&searchkey&"&anclassid="&anclassid
select case request("anclassid")
case "0"
sql1=" bookname like '%"&searchkey&"%' "
case else
sql1=" bookname like '%"&searchkey&"%' and anclassid="&request("anclassid")&" "
end select
else
'//高级查讯
sql2="searchkey="&searchkey&"&anclassid="&anclassid&"&jiage="&jiage&"&action="&action&"&selectname="&selectname
if anclassid<>0 then '//判断查讯分类,分类不为空。
select case action
case "1"
sql1=" bookname like '%"&searchkey&"%' and (shichangjia<"&jiage&" or huiyuanjia<"&jiage&" or vipjia<"&jiage&") and anclassid="&anclassid&" "
case "2"
sql1=" pingpai like '%"&selectname&"%' and (shichangjia<"&jiage&" or huiyuanjia<"&jiage&" or vipjia<"&jiage&") and anclassid="&anclassid&" "
case "3"
sql1=" bookcontent like '%"&selectname&"%' and (shichangjia<"&jiage&" or huiyuanjia<"&jiage&" or vipjia<"&jiage&") and anclassid="&anclassid&" "
end select
else
'//分类为空。
select case action
case "1"
sql1=" bookname like '%"&searchkey&"%' and (shichangjia<"&jiage&" or huiyuanjia<"&jiage&" or vipjia<"&jiage&") "
case "2"
sql1=" pingpai like '%"&selectname&"%' and (shichangjia<"&jiage&" or huiyuanjia<"&jiage&" or vipjia<"&jiage&") "
case "3"
sql1=" bookcontent like '%"&selectname&"%' and (shichangjia<"&jiage&" or huiyuanjia<"&jiage&" or vipjia<"&jiage&") "
end select
end if
end if
call sss()
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from products where "&sql1&" order by adddate desc",conn,1,1
if rs.eof And rs.bof then
Response.Write "<p align=center> 对不起，没有查讯到您需要的商品！</p><br>"
else
totalPut=rs.recordcount
if currentpage<1 then
currentpage=1
end if
if (currentpage-1)*MaxPerPage>totalput then
if (totalPut mod MaxPerPage)=0 then
currentpage= totalPut \ MaxPerPage
else
currentpage= totalPut \ MaxPerPage + 1
end if
end if
if currentPage=1 then
showContent
showpage totalput,MaxPerPage,"research_product.asp"
else
if (currentPage-1)*MaxPerPage<totalPut then
rs.move (currentPage-1)*MaxPerPage
dim bookmark
bookmark=rs.bookmark
showContent
showpage totalput,MaxPerPage,"research_product.asp"
else
currentPage=1
showContent
showpage totalput,MaxPerPage,"research_product.asp"
end if
end if
end if
sub showContent
dim i
i=0
%>
<%do while not rs.eof%>
<table width="100%" border="0" cellspacing="0" cellpadding="10" align="center">
<tr>
<td width="20%" rowspan="4">
<table align=center cellspacing=0 cellpadding=0 width=100 height=100 border=0>
<tbody>
<tr>
<td align=center>
<a href="product_inf.asp?id=<%=rs("bookid")%>" class="ziti08" target=_blank>
<%
if rs("bookpic")="" then
%>
<img src=images/emptybook.gif width=116 height=119 border="0">
<%
else
%>
<img src="<%=trim(rs("bookpic"))%>" width="116" height="119" border="0">
<%
end if
%>
</a>
</td>
</tr>
</tbody>
</table>
</td>
<td width="60%"><img src="images/ring01.gif">
<%response.write "<a class=ziti06 href=product_inf.asp?id="&trim(rs("bookid"))&" target=_blank>"&trim(rs("bookname"))&"</a>"%>
</td>
<td width="20%" rowspan="4" class="table-zuo"> <table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td align=center>
市场价：<s><%=rs("shichangjia")&"元"%></s><br>
会员价：<%="<font color=#FF6600>"&rs("huiyuanjia")&"元</font>"%><br>
VIP 价：<%="<font color=#FF3300>"&rs("vipjia")&"元</font>"%></td>
</tr>
<tr>
<td align=center>
<%response.write "<a href=""shoppingmannger.asp?id="&rs("bookid")&"&action=add""><img src=images/goumai.gif width=65 height=20 border=0></a> <a href=""shoucang.asp?id="&rs("bookid")&"&action=add""><img src='images/shoucang1.gif' width=65 height=20 border=0></a>"%>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td valign="top">
<font color="#666666">
</font>
</td>
</tr>
</table>
<table width="652" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="5"></td>
</tr>
<tr>
<td height="3" class="biaoge06"></td>
</tr>
<tr>
<td height="5"></td>
</tr>
</table>
<%i=i+1
if i>=MaxPerPage then Exit Do
rs.movenext
loop
rs.close
set rs=nothing
End Sub
Function showpage(totalnumber,maxperpage,filename)
Dim n
If totalnumber Mod maxperpage=0 Then
n= totalnumber \ maxperpage
Else
n= totalnumber \ maxperpage+1
End If
Response.Write "<form method=Post action="&filename&"?searchkey="&searchkey&"&action="&action&"&anclassid="&anclassid&"&jiage="&jiage&">"
Response.Write "<p align='center' class='contents'> "
If CurrentPage<2 Then
Response.Write "<font class='contents'>首页 上一页</font> "
Else
Response.Write "<a href="&filename&"?page=1&searchkey="&searchkey&"&action="&action&"&anclassid="&anclassid&"&jiage="&jiage&" class='contents'>首页</a> "
Response.Write "<a href="&filename&"?page="&CurrentPage-1&"&searchkey="&searchkey&"&action="&action&"&anclassid="&anclassid&"&jiage="&jiage&" class='contents'>上一页</a> "
End If
If n-currentpage<1 Then
Response.Write "<font class='contents'>下一页 尾页</font>"
Else
Response.Write "<a href="&filename&"?page="&(CurrentPage+1)&"&searchkey="&searchkey&"&action="&action&"&anclassid="&anclassid&"&jiage="&jiage&" class='contents'>"
Response.Write "下一页</a> <a href="&filename&"?page="&n&"&searchkey="&searchkey&"&action="&action&"&anclassid="&anclassid&"&jiage="&jiage&" class='contents'>尾页</a>"
End If
Response.Write "<font class='contents'> 页次：</font><font class='contents'>"&CurrentPage&"</font><font class='contents'>/"&n&"页</font> "
Response.Write "<font class='contents'> 共查讯到"&totalnumber&"种商品 "
Response.Write "<font class='contents'>转到：</font><input CLASS='wenbenkuang' type='text' name='page' size=2 maxlength=8 class=smallInput value="¤tpage&">"
Response.Write " <input type='submit' CLASS='go-wenbenkuang' class='contents' value='GO' name='cndok'></form>"
End Function
sub sss() '增加搜索关健字到数据库
if request.cookies("keyshopproducty")("username")<>"" then
set rs_s=server.CreateObject("adodb.recordset")
rs_s.open "select * from [user] where username='"&request.cookies("keyshopproducty")("username")&"'",conn,1,1
t_userid=rs_s("userid")
rs_s.close
set rs_s=server.CreateObject("adodb.recordset")
rs_s.open "select * from shop_his where username='"&request.cookies("keyshopproducty")("username")&"' and bookname='"&s_bookname&"' and lx=2",conn,1,3
if rs_s.recordcount>0 then
rs_s("ltime")=now()
rs_s("userid")=t_userid
rs_s("searchkey")=sql2
rs_s.update
rs_s.close
set rs_s=nothing
else
rs_s.close
set rs_s=server.createobject("adodb.recordset")
rs_s.open "select * from shop_his where username='"&request.cookies("keyshopproducty")("username")&"' and lx=2",conn,1,3
if rs_s.recordcount>=4 then
rs_s.delete
rs_s.update
end if
rs_s.addnew
rs_s("username")=request.cookies("keyshopproducty")("username")
rs_s("searchkey")=sql2
rs_s("bookname")=s_bookname
rs_s("userid")=t_userid
rs_s("lx")=2
rs_s("ltime")=now()
rs_s.update
rs_s.close
set rs_s=nothing
end if
end if
end sub
%>
</td>
</tr>
</table>
</td>
<td width="13" background="imager/houbu/bk004.gif"> </td>
</tr>
<tr>
<td width="13" height="10"><img src="imager/houbu/bk007.gif" width="13" height="10"></td>
<td height="10" background="imager/houbu/bk006.gif"></td>
<td width="13" height="10"><img src="imager/houbu/bk005.gif" width="13" height="10"></td>
</tr>
</table>
