<%
set conn=Server.CreateObject("ADODB.connection")
cnstr = "Provider=SQLOLEDB.1;Data Source=(local);User ID=ic;Password=19xx;Initial Catalog=ic;Persist Security Info=True"

on error resume next
conn.open cnstr
 if err then
     err.clear     
    set conn = nothing
    response.write "数据库连接出错！"
        Response.End
end if


请问下这段代码是否有错，有安全隐患没？谢谢各位大侠了   给个安全的写法

<%
On Error Resume Next

Dim Data_base
Data_base = 0 '1为MSSQLServer2000 其它为Access

Set Conn=Server.CreateObject("Adodb.Connection")

IF Data_base=1 Then
'-------------------------------------------------------------------------------------
Dim dbconn,dbip,dbdns,dbname,dbuid,dbpwd
dbconn = 1 '链接方式 1为OLEDB链接 2为驱动链接 3为DNS链接
dbip = "(local)" '数据库所在的IP地址，如果是本地数据库则为："(local)"
dbdns = "数据源DNS名称" '数据库DNS名
dbname = "MSOW" '数据库名称
dbuid = "sa" '数据库用户名
dbpwd = "********" '数据库密码
'-------------------------------------------------------------------------------------
Select CASE dbconn
Case 1
Conn.Open "Provider=SQLOLEDB;User ;Password="&dbpwd&";Initial Catalog="&dbname&";Data Source="&dbip&";"
Case 2
Conn.open "DRIVER={SQL Server};SERVER="&dbip&";UID="&dbuid&";PWD="&dbpwd&";DATABASE="&dbname&""
Case 3
Conn.open "DSN="&dbdns&";UID="&dbuid&";PWD="&dbpwd&";DATABASE="&dbname&""
End Select
Else
'-------------------------------------------------------------------------------------
Dim DB_Name,DB_Pwd
DB_Name = "#MSOW#Data.mdb" '数据库名字
DB_Pwd = "" '数据库密码,如无密码可不填写,代码自动判断选择语句。
'-------------------------------------------------------------------------------------
IF DB_Pwd="" Then
Conn.Open "Provider = Microsoft.Jet.OLEDB.4.0;Data Source = "&Server.MapPath(DB_Name)
Else
Conn.Open "Provider = Microsoft.Jet.OLEDB.4.0;Data Source = "&Server.MapPath(DB_Name)&";Jet OLEDB:Database Password="&DB_Pwd&";"
End IF
End IF

IF Err Then
Err.Clear
Conn.Close
Set Conn = Nothing
Response.Write "<Center><font color=#FF6600><strong>数据库连接出错，请检查连接设置...</strong></font></Center>"
Response.End
End IF

'只读数据
Function GetRSForRead(StrSQL)
Set RS = Server.CreateObject("Adodb.RecordSet")
RS.Source = StrSQL
RS.Open RS.Source,Conn,1,1
Set GetRSForRead = RS
End Function
'只读调用 Set RS = GetRSForRead("Select * From 数据表")

'可写数据
Function GetRSForWrite(StrSQL)
Set RS = Server.CreateObject("Adodb.RecordSet")
RS.Source = StrSQL
RS.Open RS.Source,Conn,3,3
Set GetRSForWrite = RS
End Function
'可写调用 Set RS = GetRSForWrite("Select * From 数据表")
%>