<!--#include file="inc/Conn.asp"-->
<!--#include file="inc/Function.asp"-->
<%
'*****************************************
' 作者：guke
' QQ：6692103
' http://www.my478.com
'*****************************************
Dim XH_Post,XH_In,XH_Inf,XH_Xh 
'自定义需要过滤的字串,用 "|" 分隔     ## 防注入 ##
XH_In = "<|>|(script)|on(mouseover|mouseon|mouseout|click|dblclick|blur|focus|change)|src|'|eval|\t|and|="
XH_Inf = split(XH_In,"|") 
For Each XH_Post In Request.Form 
For XH_Xh=0 To Ubound(XH_Inf) 
If Instr(LCase(Request.Form(XH_Post)),XH_Inf(XH_Xh))<>0 Then 
Response.End 
End If 
Next 
Next

function RemoveHTML(fString)
  dim   re   
  set   re   =   New   RegExp   
  re.Global   =   True   
  re.IgnoreCase   =   True   
  if   not   isnull(fString)   then   
  re.Pattern   =   "<(.[^>]*)>"   
  fString   =   re.Replace(fString,"") 
   fString   =  Replace(fString,"&nbsp;","")  
  RemoveHTML   =   fString   
  end   if 
end function

function cutstr(tempstr,tempwid)
if len(tempstr)>tempwid then
cutstr=left(tempstr,tempwid)&"..."
else
cutstr=tempstr
end if
end function

Dim last,amount
response.charset = "gb2312"
last = request.form("last")
amount = request.form("amount")
TID=request("TID")
TypeID=request("TypeID")
if last="" or amount="" then
Response.End
end if

i=0
set rs=server.createobject("adodb.recordset")
if last=0 then
sql="select top "&amount&" * from [Dream_Review] where id<>0 and Dream_ViewID="&TID&" and Dream_Look=true order by id desc"
else
sql="select top "&amount&" * from [Dream_Review] where id<>0 and Dream_ViewID="&TID&" and Dream_Look=true and id not in (select top "&last&" id from [Dream_Review] where id<>0 and Dream_ViewID="&TID&" and Dream_Look=true order by id desc) order by id desc"
end if
rs.open sql,conn,1,1
if rs.eof then
Response.End
else
response.write "["
do while not rs.eof
if rs("Dream_Grade")<>"" then
Dream_Review=rs("Dream_Grade")&"分"
else
Dream_Review="无评分"
end if

if i=0 then
response.write "{""new_review_name"":""<i>"&rs("Dream_UserID")&"</i> ["&rs("Dream_UpdateTime")&"]"",""new_review_grade"":"""&Dream_Review&""",""new_review_con"":"""&rs("Dream_Content")&""",""new_review_title"":"""&rs("Dream_Title")&"""}"
else
response.write ",{""new_review_name"":""<i>"&rs("Dream_UserID")&"</i> ["&rs("Dream_UpdateTime")&"]"",""new_review_grade"":"""&Dream_Review&""",""new_review_con"":"""&rs("Dream_Content")&""",""new_review_title"":"""&rs("Dream_Title")&"""}"
end if
i=i+1
rs.movenext
loop
end if
response.write "]"
rs.close
%>