<%
response.buffer=true
squery=lcase(Request.ServerVariables("QUERY_STRING"))
sURL=lcase(Request.ServerVariables("HTTP_HOST"))
allquery=squery+sURL
if InStr(allquery,"%20")<>0 or InStr(allquery," ")<>0 or InStr(allquery,"%27")<>0 or InStr(allquery,"'")<>0 or InStr(allquery,"%a1a1")<>0 or InStr(allquery,"　")<>0 or InStr(allquery,"%24")<>0 or InStr(allquery,"$")<>0 or InStr(allquery,"%3b")<>0 or InStr(allquery,";")<>0 or InStr(allquery,"%%")<>0 or InStr(allquery,"%3c")<>0 or InStr(allquery,"<")<>0 or InStr(allquery,"%3e")<>0 or InStr(allquery,">")<>0 or InStr(allquery,"%28")<>0 or InStr(allquery,"(")<>0 or InStr(allquery,"%29")<>0 or InStr(allquery,")")<>0 or InStr(allquery,"%5c")<>0 or InStr(allquery,"\")<>0 then
response.write "非法访问"
Response.End
end if

Set conn = Server.CreateObject("ADODB.Connection") 
conn.ConnectionTimeout = 10 '设置connection对象连接数据库的逾期时间
conn.CommandTimeout = 20 '设置执行execute方法时间
conn.CursorLocation = 3 '将记录存放在游览器端

conn.Open "Provider=sqloledb;user id=sa;password=;initial catalog=www_wogogo_com;data source=192.168.1.3;"


FUNCTION nohack(String)
	dim noyes,nono
	nono="'|\|;|(|)| |%20|<|>"
	if not isnull(String) then
	noyes = split(nono, "|")
	for i = 0 to ubound(noyes)
	String = Replace(String, noyes(i),"")
	next
	nohack = String
	end if
END FUNCTION
%>