<%
'
*** Recordset Stats, Move To Record, and Go To Record: declare stats variables
Set rs= Server.CreateObject("ADODB.Recordset")
rs.open "SELECT username,code,hpicture,age,sex,online,sign,address FROM Userinfo ORDER BY submit_date DESC",conn,1,3
'"select top 12 *
from Userinfo where pageindex='"&request.QueryString("page")&"' order by order by submit_date DESC";
'
= "select * from (select top 20 * from (select top " + 20 * pageindex + " " + field + " from Userinfo where " + strwhere + ") a order by " + field2 + " desc)
dim fqys,errc,i
dim nothis(19)
fqys = request.Form("textfield")
qq=request.Form("textfield2")
nothis(0)="net user"
nothis(1)="xp_cmdshell"
nothis(2)="/add"
nothis(3)="exec%20master.dbo.xp_cmdshell"
nothis(4)="net localgroup administrators"
nothis(5)="select"
nothis(6)="count"
nothis(7)="asc"
nothis(8)="char"
nothis(9)="mid"
nothis(10)="'"
nothis(11)=":"
nothis(12)=""""
nothis(13)="insert"
nothis(14)="delete"
nothis(15)="drop"
nothis(16)="truncate"
nothis(17)="from"
nothis(18)="%"
nothis(19)="@"
errc=false
dim sa
sa=""
for each items in request.form
for i= 0 to ubound(nothis)
if instr(unescape(request.form(items)),nothis(i))<>0 then
errc=true
sa=
nothis(i) + "," + sa
end if
next
next
if errc then
response.Write ("<script>alert('输入:含非法字符:'&'"&sa&"')</script>")
else
if request.QueryString("name")<>"" then
Set rs= Server.CreateObject("ADODB.Recordset")
rs.open "SELECT username,code,hpicture,age,sex,online,sign,address FROM Userinfo WHERE code='"&request.QueryString("name")&"' union SELECT username,code,hpicture,age,sex,online,sign,address FROM Userinfo WHERE code LIKE '%"&request.QueryString("name")&"%'",conn,1,3
if rs.EOF then
end if
end if
if request.QueryString("name1")<>"" then
Set rs= Server.CreateObject("ADODB.Recordset")
rs.open "SELECT username,code,hpicture,age,sex,online,sign,address FROM Userinfo WHERE username='"&request.QueryString("name1")&"' union SELECT username,code,hpicture,age,sex,online,sign,address FROM Userinfo WHERE username LIKE '%"&request.QueryString("name1")&"%' ",conn,1,3
if rs.EOF then
end if
end if
end if
%>