<%
'乘风多用户计数器
'作者QQ：178575
'作者EMail：yliangcf@163.com
'作者网站：http://www.qqcf.com
'详细简介：http://www.qqcf.com/cfcount.htm
'上面有程序在线演示，安装演示，使用疑难解答，最新版本下载等内容
'因为这些内容可能时常更新，没有放在程序里，请自己上网站上查看
%>
<%
DbPath="data/#cfcount.mdb"	'数据库文件名设置。

On Error Resume Next
ConnStr = "Provider = Microsoft.Jet.OLEDB.4.0;Data Source = " & Server.MapPath(DbPath)
Set Conn = Server.CreateObject ("Adodb.Connection")
Conn.Open ConnStr

If Err Then
 err.Clear
 Set Conn = Nothing
 Response.Write "数据库连接出错，请检查连接字串！"
 Response.End
End If


AdminOnlineExecSql=0 	'是否允许超级管理员后台数据库管理里在线执行Sql，0为否，1为是，默认为否

Action=ChkStr(Request("Action"),1)

Set RsSet=Server.CreateObject("Adodb.RecordSet")
Sql="Select Top 1 * From CFCount_Admin Order By ID"
RsSet.Open Sql,Conn,1,1


'系统安全码
SysCode=RsSet("SysCode")

'系统名称
SysTitle=RsSet("SysTitle")

'--使用的模板名称
TemplateName=RsSet("TemplateName")

'表格边框颜色
TableBorderColor=GetSkinColor(RsSet("SkinColor"),0)
'表格行的标题背景颜色
TableHeadBgColor=GetSkinColor(RsSet("SkinColor"),1)
'字体颜色
FontColor=GetSkinColor(RsSet("SkinColor"),2)
'链接颜色：
LinkColor=GetSkinColor(RsSet("SkinColor"),3)
'点过的链接颜色
LinkOverColor=GetSkinColor(RsSet("SkinColor"),4)




If Action<>"upsave" And Action<>"sqlexesave" Then'--上传文件(否则会上传不了文件)和在线执行sql时除外
	if Request.QueryString<>"" then call stophacker(Request.querystring,"'|\b(alert|confirm|prompt)\b|<[^>]*?>|^\+/v(8|9)|\bonmouse(over|move)=\b|\b(and|or)\b.+?(>|<|=|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")  
	If Request.Form<>"" Then call stophacker(Request.Form,"^\+/v(8|9)|\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|<\s*img\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")  
	if Request.Cookies<>"" then call stophacker(Request.Cookies,"\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")   
	SvEntStr=Request.ServerVariables("HTTP_USER_AGENT") &" "& Request.ServerVariables("HTTP_REFERER")  &" "&  Request.ServerVariables("HTTP_X_FORWARDED_FOR")
	call test(SvEntStr,"'|\b(and|or)\b.+?(>|<|=|\bin\b|\blike\b)|/\*.+?\*/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)")
End If

function test(values,re)
	dim regex
	set regex=new regexp
	regex.ignorecase = true
	regex.global = true
	regex.pattern = re
	if regex.test(values) then
		Response.Write("<div style='position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;'><br>您的提交带有不合法参数,谢谢合作!<br><br></div>")  
		Response.end
	end if
	set regex = nothing
end function

function stophacker(values,re)
	dim l_get, l_get2,n_get,regex,IP
	for each n_get in values
		for each l_get in values
			l_get2 = values(l_get)
			set regex = new regexp
			regex.ignorecase = true
			regex.global = true
			regex.pattern = re
			if regex.test(l_get2) then
				Response.Write("<div style='position:fixed;top:0px;width:100%;height:100%;background-color:white;color:green;font-weight:bold;border-bottom:5px solid #999;'><br>您的提交带有不合法参数,谢谢合作!<br><br></div>")  
				Response.end
			end if
			set regex = nothing
		next
	next
end function
%>