<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<!--#include virtual="/inc/connupfile.asp"-->
<!--#include virtual="/inc/connhost.asp"-->
<!--#include file="upload_5xsoft.inc" -->
<%
response.End()

%>
<%
set upload=new upload_5xsoft 

Function SafeRequestform(ParaName) 
Dim ParaValue 
ParaValue=upload.form(ParaName)
if IsNumeric(ParaValue)  then
SafeRequestform=ParaValue
exit Function
else
ParaValuetemp=lcase(ParaValue)
tempvalue="select |insert |delete from|'|count(|drop table|update |truncate  |asc(|mid(|char(|xp_cmdshell|exec master|net localgroup administrators|net user| or | and |%20from|*|{|}|[|]|~|$|chr|mid|char|create|into|values|drop"
temps=split(tempvalue,"|")
for mycount=0 to ubound(temps)
if  Instr(ParaValuetemp,temps(mycount)) > 0 then
		response.Write("非法请求"&temps(mycount)) 'call errorpage(-2,"警告!非法请求！！！"&GetUrl&":"&temps(mycount)&"")
	     call PopErr("出现错误请检查表单")
		'response.Redirect("/err.asp")
		response.end
end if 
next
SafeRequestform=ParaValue
end if
End function



lujing="\updata\updown\"&trim(request.Cookies("aymd5"))  '检查文件夹
Set fso=CreateObject("Scripting.FileSystemObject") 
if fso.folderexists(server.mappath(lujing))=false then 
fso.CreateFolder(Server.MapPath(lujing))
end if

'if fso.folderexists(server.mappath("\updown\abc")) then   '删除文件夹
'fso.DeleteFolder(server.mappath("\updown\abc"))
'end if

'if fso.fileexists(server.mappath("sss.ASP")) then   '检查文件
'response.erite"sss.asp文件存在" 
'else 
'response.write"sss.asp文件不存在" 
'end if 

'if fso.FileExists(server.mappath("\updown\admin\推 广.txt")) then   '删除文件
'fso.DeleteFile(server.mappath("\updown\admin\推 广.txt"))
'end if


  Function CheckFileExt(FileName,ExtName) 
    FileType = ExtName 
	
	jiancha=Split(FileName,".")
	if Ubound(jiancha)>1 then 
	CheckFileExt = False
	Exit Function
	end if
	jiancha=Split(FileName,";")
	if Ubound(jiancha)>0 then 
	CheckFileExt = False
	Exit Function
	end if
    FileType = Split(FileType,",")
	For i = 0 To Ubound(FileType)
      If LCase(Right(FileName,3)) = LCase(FileType(i)) then
      CheckFileExt = True
      Exit Function
      Else
      CheckFileExt = False
      End if
	  
    Next
  End Function
  
ExtName = "txt,rar" 'txt,rar,zip,doc,xls
downpass=SafeRequestform("downpass")
kejian=SafeRequestform("kejian")
'furl="http://"&SafeRequestform("url")&"/user/mydown"


set file=upload.file("file1")

iCount=0
'for each formName in upload.objForm ''列出所有form数据
'response.write formName&"="&upload.form(formName)&"<br>"
'next

for each formName in upload.objFile ''列出所有上传了的文件
set file=upload.file(formName)  ''生成一个文件对象
if fso.fileexists(Server.mappath(lujing&"\"&file.FileName)) then 
call PopErr2("该文件已存在","mydown")
end if 
if file.filesize>100*1000 then '设置上传文件大小为100K
call PopErr("文件大小超过了限制") 
response.end 
end if 
if CheckFileExt(file.FileName,ExtName)=false then
call PopErr("文件格式错误") 
response.end 
end if
next

sql="select * from aydown where aydownuser='"&trim(request.Cookies("aymd5"))&"'" 
rs.open sql,conn,1,3

for each formName in upload.objFile ''列出所有上传了的文件
set file=upload.file(formName)  ''生成一个文件对象
if file.FileSize>0 then         ''如果 FileSize > 0 说明有文件数据
file.SaveAs Server.mappath(lujing&"\"&file.FileName)   ''保存文件
rs.addnew 
rs("aydownuser")=trim(request.Cookies("aymd5"))        		'文本 所属会员
rs("aydownname")=file.FileName       						 '文本 文件名称
rs("aydownlujing")=hosturl&"updata/updown/"&trim(request.Cookies("aymd5"))&"/"&file.FileName     			 '文本 文件路径
if trim(downpass)<>"" then rs("aydownpass")=trim(downpass)   '文本 下载密码
if kejian="" then rs("aydownkejian")=1      				'数字 是否可见 0可见 1不可见
rs.update
iCount=iCount+1
end if
next
rs.close
set file=nothing
set upload=nothing  ''删除此对象
call logadd(request.Cookies("aynameid"),"文件上传成功",0,0)
call PopErr2("文件上传成功","mydown")
 %>

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>无标题文档</title>
</head>

<body>

</body>
</html>

 
