<%
dim sql_leach,sql_leach_0,Sql_DATA,SQL_Get,Sql_Post 
sql_leach = "',exec,insert,select,delete,update,count,chr,mid,master,truncate,char,declare"
sql_leach_0 = split(sql_leach,",")

If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
For SQL_Data=0 To Ubound(sql_leach_0)
If instr(Request.QueryString(SQL_Get),sql_leach_0(Sql_DATA))>0 Then
Response.Write "<script>alert('执行错误：\n表单中请勿包含 "&replace(sql_leach_0(Sql_DATA),"'","’")&" 字符！')</script>"
Response.end
End If
Next
Next
End If

If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For SQL_Data=0 To Ubound(sql_leach_0)
If instr(Request.Form(Sql_Post),sql_leach_0(Sql_DATA))>0 Then
Response.Write "<script>alert('提交错误：\n表单中请勿包含 "&replace(sql_leach_0(Sql_DATA),"'","’")&" 字符！')</script>"
Response.end
End If
Next
Next
End If

dim conn   
dim connstr
connstr = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(db)   
set conn=server.createobject("ADODB.CONNECTION")
if err.number<>0 then 
	err.clear
	set conn=nothing
	response.write "数据库连接出错！"
	Response.End
else
	conn.open connstr
	if err then 
		err.clear
		set conn=nothing
		response.write "数据库连接出错！"
		Response.End 
	end if
end if
%>
