asp简单的ajax留言板(采用三层模式)

时间:2007-04-02 21:39:56   来源:  作者:  点击:次  出处:技术无忧
关键字:留言板 三层模式 漏洞


   '/// <summary>
   '/// 根据条件列出所有信息(带有分页)
   '/// </summary>
   '/// <param name="PageSize">每页记录数</param>
   '/// <param name="CurrentPage">页码</param>
   '/// <param name="WhereValue">判断值</param>
   '/// <param name="OrderValue">排序</param>
   '/// <returns>返回objRS</returns>
   Public Function FindByPage(PageSize,CurrentPage,WhereValue,OrderValue)
  
   Dim parms,SQL,objRS
   Dim s1
   If CurrentPage="0" Then
   s1 = PageSize & "|" + OrderValue & "|" & WhereValue
   parms = Split(s1,"|")
   SQL = mycom.Format(SQL_05,parms)
   Else
   s1 = PageSize & "|" & OrderValue & "|" + WhereValue & "|" & CurrentPage*PageSize
   parms = Split(s1,"|")
   SQL = mycom.Format(SQL_06,parms)
   End If
  
   Set objRS = myacc.ExecuteReader(myacc.CONN_STRING,SQL)
   Set FindByPage = objRS
  
   End Function
  
  
   Private Sub Class_Initialize()
  
   SQL_01 = "Select * From [Guest] Where Id = {0}"
   SQL_02 = "Insert into [Guest] ([Content],[Re],[Addtime],[Ip]) values('{0}','{1}','{2}','{3}')"
   SQL_03 = "Update [Guest] Set [Content]='{1}',[Re]='{2}',[Addtime]='{3}',[Ip]='{4}' Where Id = {0}"
   SQL_04 = "Delete From [Guest] Where Id In ({0})"
   SQL_05 = "Select Top {0} * From [Guest] Where Content Like '%{2}%' Order By {1} Desc,Id Desc"
   SQL_06 = "Select Top {0} * From [Guest] Where Content Like '%{2}%' And Id Not IN(Select Top {3} Id From [Guest] Where Content Like '%{2}%' Order By {1} Desc,Id Desc) Order By {1} Desc,Id Desc"
   SQL_07 = "Select * From [Guest] Where Content Like '%{0}%' "
  
   Set mycom = new Common
   Set myacc = new AccHelper
   Set mymod = new MOD_Guest
  
   End Sub
  
   Private Sub Class_Terminate()
  
   Set mycom = Nothing
   Set myacc = Nothing
   Set mymod = Nothing
  
   End Sub
  
   End Class
  %>
  
  MOD_Guest.asp
  <%
   '/// <summary>
   '/// 摘要说明。
   '/// </summary>
   Class MOD_Guest
  
   Public Id
   Public Content
   Public Re
   Public Addtime
   Public Ip
  
   Public Sub SetVar(vId,vContent,vRe,vAddtime,vIp)
   Id=vId
   Content=vContent
   Re=vContent
   Addtime=vAddtime
   Ip=vIp
   End Sub
  
   End Class
  %>
  
  Common.asp
  <%
   '/// <summary>
   '/// 摘要说明
   '/// </summary>
   Class Common
  
   '/// <summary>
   '/// 获得信息
   '/// </summary>
   '/// <param name="Id">需要内容</param>
   '/// <param name="Id">替换关键字</param>
   '/// <returns>格式化后内容</returns>
   Public Function Format(str,arr)
  
   Dim r,i
   r = str
   For i = 0 To UBound(arr)
   r = Replace(r,"{"&i&"}",arr(i))
   Next
   Format = r
  
   End Function
  
   Public Function Page(PageSize,CurrentPage,RecordCount,PageUrl)
  
   const C_RECORDCOUNT = "合计<STRONG><FONT color=""red"">{0}</FONT></STRONG>篇 |"
   const C_FIRSTPAGE1 = " <a href=""#"" onclick=""$('{0}&PageNo={1}')"">首页</a>"
   const C_FIRSTPAGE2 = " 首页"
   const C_PREVPAGE1 = " <a href=""#"" onclick=""$('{0}&PageNo={1}')"">上一页</a>"
   const C_PREVPAGE2 = " 上一页"
   const C_NEXTPAGE1 = " <a href=""#"" onclick=""$('{0}&PageNo={1}')"">下一页</a>"
   const C_NEXTPAGE2 = " 下一页"
   const C_LASTPAGE1 = " <a href=""#"" onclick=""$('{0}&PageNo={1}')"">尾页</a>"
   const C_LASTPAGE2 = " 尾页"
   const C_CURRENTPAGE = " 页次:<STRONG><FONT color=""red"">{0}</FONT>/{1}</STRONG>页"
   const C_PAGESIZE = " <STRONG>{0}</STRONG>篇/页  "
   const C_GOTOPAGE = " 跳转:<input type=""text"" name=""goto"" value=""{1}"" onchange=""$('{0}&PageNo='+this.value)"" style=""width:20px;border:1px""/>  "
  
   Dim PageCount,pages
   Dim lRecordCount,lFirstpage,lPrevpage,lNextpage,lLastpage,lCurrentpage,lPagesize,lGotopage
   Dim p,parms
  
   If RecordCount Mod PageSize <> 0 Then
   pages = 1
   else
   pages = 0
   End If
   PageCount=CInt(RecordCount/PageSize + pages)
  
   parms=Array(RecordCount)
   lRecordCount = Format(C_RECORDCOUNT,parms)
  
   if CInt(CurrentPage)>1 Then
   parms=Array(Pageurl,1)
   lFirstpage = Format(C_FIRSTPAGE1,parms)
   parms=Array(Pageurl,CInt(CurrentPage)-1)
   lPrevpage = Format(C_PREVPAGE1,parms)
   Else
   lFirstpage=C_FIRSTPAGE2
   lPrevpage=C_PREVPAGE2
   End If
  
   if CInt(CurrentPage)<PageCount Then
   parms=Array(Pageurl,CInt(CurrentPage)+1)
   lNextpage = Format(C_NEXTPAGE1,parms)
   parms=Array(Pageurl,CInt(CurrentPage)+1)
   lLastpage = Format(C_LASTPAGE1,parms)
   Else
   lNextpage=C_NEXTPAGE2
   lLastpage=C_LASTPAGE2
   End If
  
   parms=Array(CurrentPage,PageCount)
   lCurrentpage = Format(C_CURRENTPAGE,parms)
   parms=Array(PageSize)
   lPagesize = Format(C_PAGESIZE,parms)
   parms=Array(Pageurl,CurrentPage)
   lGotopage = Format(C_GOTOPAGE,parms)
  
   p=lRecordCount&lFirstpage&lPrevpage&lNextpage&lLastpage&lCurrentpage&lPagesize&lGotopage
   Page = p
  
   End Function
  
   End Class
  %>
  
  AccHelper.asp
  <%
   '/// <summary>
   '/// AccHelper 的摘要说明。
   '/// </summary>
   Class AccHelper
  
   Public CONN_STRING
  
   '/// <summary>
   '/// 执行ExecuteNonQuery
   '/// </summary>
   '/// <param name="connString">连接字符</param>
   '/// <param name="cmdText">sql命令</param>
   Public Function ExecuteNonQuery(connString,cmdText)
  
   Dim objConn
   Set objConn = Server.CreateObject("ADODB.Connection")
   objConn.Open connString
   objConn.Execute(cmdText)
  
   End Function
  
   '/// <summary>
   '/// 执行ExecuteReader
   '/// </summary>
   '/// <param name="connString">连接字符</param>
   '/// <param name="cmdText">sql命令</param>
   '/// <returns>RS</returns>
   Public Function ExecuteReader(connString,cmdText)
  
   Dim objConn,objRS
   Set objConn = Server.CreateObject("ADODB.Connection")
   objConn.Open connString
   Set objRS = objConn.Execute(cmdText)
   Set ExecuteReader = objRS
  
   End Function
  
   '/// <summary>
   '/// 执行Recordset
   '/// </summary>
   '/// <param name="connString">连接字符</param>
   '/// <param name="cmdText">sql命令</param>
   '/// <returns>RS</returns>
   Public Function Recordset(connString,cmdText)
  
   Dim objConn,objRS
   Set objConn = Server.CreateObject("ADODB.Connection")
   objConn.Open connString
   Set objRS = Server.CreateObject("ADODB.RecordSet")
   objRS.Open cmdText,objConn,1,3
   Set Recordset = objRS
  
   End Function
  
   Private Sub Class_Initialize()
   CONN_STRING = "provider = microsoft.jet.oledb.4.0;data source=" & Server.Mappath("db.mdb")
   End Sub
  
   End Class
  %>

技术无忧.com


文章评论

共有 0 位网友发表了评论 此处只显示部分留言 点击查看完整评论页面