扫描两页面提示:execute()函数可以执行任意ASP代码,怎么修改?

[lansam]

第一页
<%@language="javascript"%>
<%
var dbConn = Server.CreateObject("adodb.connection");
dbConn.Open("Provider=Microsoft.Jet.OLEDB.4.0;Data Source="+Server.Mappath("czp&zi/Content.mdb"));
var ResponseHTML="";
function List(key,id)
{
var dbCmd=Server.CreateObject("adodb.command");
with(dbCmd){
ActiveConnection = dbConn;
CommandType = 4;
CommandText = "sp_select";
var objRs=Execute(null,(id?id:0));
}
var str = "";
var x = 0;
while(!objRs.eof)
{
str += '["'+String(objRs("content"))+'","'+String(objRs("content"))+'"],';
if(objRs("children")>0)
{
List(key+"_"+x,String(objRs("id")));
}
objRs.movenext;
x++;
}
dbCmd=null;
objRs=null;
if(x>0)
ResponseHTML= ("dsy.add(\""+key+"\",["+str.slice(0,-1)+"]);\n") +ResponseHTML;
}
List(0);
dbConn.Close();
dbConn=null;
Response.Write(ResponseHTML);
%>


第二页
<%@language="javascript"%>
<%
var dbConn = Server.CreateObject("adodb.connection");
dbConn.Open("Provider=Microsoft.Jet.OLEDB.4.0;Data Source="+Server.Mappath("../czp&zi/Info.mdb"));
var ResponseHTML="";
function List(key,id)
{
var dbCmd=Server.CreateObject("adodb.command");
with(dbCmd){
ActiveConnection = dbConn;
CommandType = 4;
CommandText = "sp_select";
var objRs=Execute(null,(id?id:0));
}
var str = "";
var x = 0;
while(!objRs.eof)
{
str += '["'+String(objRs("content"))+'","'+String(objRs("content"))+'"],';
if(objRs("children")>0)
{
List(key+"_"+x,String(objRs("id")));
}
objRs.movenext;
x++;
}
dbCmd=null;
objRs=null;
if(x>0)
ResponseHTML= ("dsy.add(\""+key+"\",["+str.slice(0,-1)+"]);\n") +ResponseHTML;
}
List(0);
dbConn.Close();
dbConn=null;
Response.Write(ResponseHTML);
%>

[hyjno9]

鄙视蛋贴