<%'SQL注入式攻擊防范
squery=lcase(Request.ServerVariables("QUERY_STRING"))
sURL=lcase(Request.ServerVariables("HTTP_HOST"))
allquery=squery+sURL
if InStr(allquery,"%20")<>0 or InStr(allquery,"%27")<>0 or InStr(allquery,"'")<>0 or InStr(allquery,"%a1a1")<>0 or InStr(allquery,"%24")<>0 or InStr(allquery,"$")<>0 or InStr(allquery,"%3b")<>0 or InStr(allquery,";")<>0 or InStr(allquery,":")<>0 or InStr(allquery,"%%")<>0 or InStr(allquery,"%3c")<>0 or InStr(allquery,"<")<>0 or InStr(allquery,">")<>0 or InStr(allquery,"--")<>0 or InStr(allquery,"sp_")<>0 or InStr(allquery,"xp_")<>0 or InStr(allquery,"exec")<>0 or InStr(allquery,"\")<>0 or InStr(allquery,"delete")<>0 or InStr(allquery,"dir")<>0 or InStr(allquery,"exe")<>0 or InStr(allquery,"select")<>0 or InStr(allquery,"Update")<>0 or InStr(allquery,"cmd")<>0 or InStr(allquery,"*")<>0 or InStr(allquery,"^")<>0 or InStr(allquery,"(")<>0 or InStr(allquery,")")<>0 or InStr(allquery,"+")<>0 or InStr(allquery,"copy")<>0 or InStr(allquery,"format")<>0 or not(isnumeric(request("id"))) then%>
<script Language="JavaScript">window.top.location.href="conn/Error.asp?allquery=<%=allquery%>"</script>
<%Response.End
end if


response.buffer=true              '啟用緩沖處理

'用戶自定義
dim db,password
db="../database/sia-cart.asp"     '數據庫名字
password="siacart"                '數據庫密碼




On Error Resume Next               '防止暴庫處理

Set conn=Server.CreateObject("ADODB.Connection")
conn.open= "Provider=Microsoft.Jet.OLEDB.4.0;" & _
            "Data Source=" & Server.MapPath(db) & _
             ";Jet OLEDB:Database Password=" & password
If Err Then
		err.Clear
		Set Conn = Nothing
		Response.Write "數據庫連接出錯，請檢查連接字串。防止暴庫處理。"
		Response.End
End If
%>