<%
'SQL防注入函数
dim sql_injdata,SQL_inj,SQL_Get,SQL_Data
SQL_injdata= "'|script|iframe|eval|exec|%20and|%20or|exec%20|insert%20|select%20|delete%20|update |count |%|chr|mid|master|truncate|char|declare|--" 
SQL_inj = split(SQL_Injdata,"|") 
If Request.QueryString <> "" Then 
  For Each SQL_Get In Request.QueryString 
     For SQL_Data=0 To Ubound(SQL_inj) 
        if len(Request.QueryString(SQL_Get))>30 or instr(UCase(Request.QueryString(SQL_Get)),UCase(Sql_Inj(Sql_DATA)))>0 Then 
         Response.Write "<Script Language=javascript>alert('参数错误，请不要注入!');history.back(-1);</Script>" 
         Response.end 
        end if 
     next 
   Next 
End If

dim conn
dim connstr
dim db
db="../Databases/#hydb.asp" '数据库文件位置
on error resume next
connstr="DBQ="+server.mappath(""&db&"")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
set conn=server.createobject("ADODB.CONNECTION")
if err then
err.clear
else
conn.open connstr
end if

sub CloseConn()
	conn.close
	set conn=nothing
end sub

%>
