34,873
社区成员
发帖
与我相关
我的任务
分享
/*
#############################################################
# 创建唯一标识数据表
#############################################################
*/
if exists (select * from dbo.sysobjects where id = object_id(N'[dbo].[Admin_Guid]') and OBJECTPROPERTY(id, N'IsUserTable') = 1) drop table [dbo].[Admin_Guid]
/* -- 写入表格式 -- */
CREATE TABLE [dbo].[Admin_Guid]
(
[ID] [int] IDENTITY (1, 1) NOT NULL ,
[Ip] [nvarchar] (32) COLLATE Chinese_PRC_CI_AS NOT NULL ,
) ON [PRIMARY]
/*
#############################################################
# 创建推广统计数据表
#############################################################
*/
if exists (select * from dbo.sysobjects where id = object_id(N'[dbo].[Admin_Dvip]') and OBJECTPROPERTY(id, N'IsUserTable') = 1) drop table [dbo].[Admin_Dvip]
/* -- 写入表格式 -- */
CREATE TABLE [dbo].[Admin_Dvip]
(
[ID] [int] IDENTITY (1, 1) NOT NULL ,
[Admi] [nvarchar] (16) COLLATE Chinese_PRC_CI_AS NOT NULL ,
[Quan] [int] NOT NULL ,
[Qime] [datetime] NOT NULL
) ON [PRIMARY]
<!--#include file="Conn.Asp"-->
<%
'#############################################################
'# SQL防注入
'#############################################################
Function NoSql(FS_inputStr)
Dim f_NoSqlHack_AllStr,f_NoSqlHack_Str,f_NoSqlHack_i,Str_InputStr
Str_InputStr = FS_inputStr
f_NoSqlHack_AllStr ="'|;|(|)|dbcc|alter|drop|*|and|exec|insert|or|select|delete|update|count|%|chr|mid|char|master|truncate|declare|set|where|xp_cmdshell|tab"
f_NoSqlHack_Str = Split(f_NoSqlHack_AllStr,"|")
For f_NoSqlHack_i=LBound(f_NoSqlHack_Str) To Ubound(f_NoSqlHack_Str)
If Instr(LCase(Str_InputStr),f_NoSqlHack_Str(f_NoSqlHack_i)) <> 0 Then
If f_NoSqlHack_Str(f_NoSqlHack_i) = "'" Then f_NoSqlHack_Str(f_NoSqlHack_i) = " \' "
Call ConnClose()
Response.End
End If
Next
NoSql = Replace(Replace(Str_InputStr,"'","''"),"%27","''")
End Function
'#############################################################
'# 关闭数据库对象
'#############################################################
Function ConnClose()
CN.Close
Set CN = Nothing
End Function
'#############################################################
'#
'#############################################################
Function CheckCF(Str_Sql)
CheckCF = Cn.ExeCute(Str_Sql)(0)
End Function
'#############################################################
'# 写入推广分析
'#############################################################
Function WriteDvip(Str_Dvip,Str_Guid,Str_Date)
Select Case IsSqlDataBase
Case 0 'Access数据库
Str_Sql = "Select Count(*) From Admin_Guid Where Ip='" & Str_Guid & "'"
Case 1 'MSSQL数据库
Str_Sql = "Select Count(*) From Admin_Guid Where Ip='" & Str_Guid & "'"
End Select
If CheckCF(Str_Sql) = 0 Then '判断 Admin_Guid 表中 Ip 字段有无 Str_Guid 数据!
Cn.ExeCute "Insert Into Admin_Guid(Ip) Values('" & Str_Guid &"')" '写入 Admin_Guid 表 Ip 字段!
Select Case IsSqlDataBase
Case 0 'Access数据库
Str_Sql = "Select Count(*) From Admin_Dvip Where Admi='" & Str_Dvip & "' And Qime=#" & Str_Date & "#"
Case 1 'MSSQL数据库
Str_Sql = "Select Count(*) From Admin_Dvip Where Admi='" & Str_Dvip & "' And Qime='" & Str_Date & "'"
End Select
If CheckCF(Str_Sql) = 0 Then '判断 Admin_Dvip 表中有无 Admi 和 Qime 条件的数据,没有就创建一条!
Cn.ExeCute "Insert Into Admin_Dvip(Admi,Quan,Qime) Values('" & Str_Dvip & "',1,'" & Str_Date & "')"
Else 'Admin_Dvip 表中有 Admi 和 Qime 条件的数据 , 就 Quan 字段 加1
Select Case IsSqlDataBase
Case 0 'Access数据库
Cn.ExeCute "Update Admin_Dvip Set Quan=Quan+1 Where Qime=#" & Str_Date & "# And Admi='" & Str_Dvip & "'"
Case 1 'MSSQL数据库
Cn.ExeCute "Update Admin_Dvip Set Quan=Quan+1 Where Qime='" & Str_Date & "' And Admi='" & Str_Dvip & "'"
End Select
End If
End If
End Function
'#############################################################
'# 参数获取
'#############################################################
Dim Str_Dvip,Str_Guid,Str_Date
'----------------------------------------------------------------------------------------------------------------------------
Str_Dvip = NoSql(Trim(Request.Form("Dvip"))) '推广帐号
Str_Guid = NoSql(Trim(Request.Form("Guid"))) '唯一标识
Str_Date = NoSql(Date()) '提交日期
'----------------------------------------------------------------------------------------------------------------------------
If Str_Dvip = "" Or Str_Guid = "" Or Len(Str_Guid) <> 32 Or Str_Date = "" Then
Call ConnClose()
Response.End()
End If
'#############################################################
'# 写入推广分析
'#############################################################
Call WriteDvip(Str_Dvip,Str_Guid,Str_Date)
Call ConnClose()
Response.End()
%>

'#############################################################
'# 写入推广分析
'#############################################################
Function WriteDvip(Str_Dvip,Str_Guid,Str_Date)
Select Case IsSqlDataBase
Case 0 'Access数据库
Str_Sql = "Select Count(*) From Admin_Guid Where Ip='" & Str_Guid & "'"
Case 1 'MSSQL数据库
Str_Sql = "Select Count(*) From Admin_Guid Where Ip='" & Str_Guid & "'"
End Select
If CheckCF(Str_Sql) = 0 Then
Select Case IsSqlDataBase
Case 0 'Access数据库
Cn.ExeCute "Insert Into Admin_Guid(Ip) Values('" & Str_Guid &"')"
'在里加一句SQL,能够代替下面的其它判断!但是效率和效果都一样!
Case 1 'MSSQL数据库
Cn.ExeCute "Insert Into Admin_Guid(Ip) Values('" & Str_Guid &"')"
'在里加一句SQL,能够代替下面的其它判断!但是效率和效果都一样!
End Select
End If
End Function

