<%
'========================================================================================
' 文 件 名: checkru.asp
' 版    本: 岭峰网行业专用留言系统3.10.0 (LFMessS 2020 - 3.10.0.F Build 200604)
' 说    明: 黑客攻击通用防范文件 | 请勿自行修改该处文件，以确保程序正确的执行
' 插件版本: 3.5 < NoCooike >
' 文件日期: 2020-06-04
' 设 计 者: 疾风之狼
'========================================================================================
' 郑州文达岭峰网络科技有限公司.
'========================================================================================
' Copyright (C) 2001-2018 岭锋网. All rights reserved.
' 网    站: http://www.lfmesss.com
' 电子邮件: support@lfmesss.com
' 联系ＱＱ: 85112407
'========================================================================================

Dim LingFengNet_MS_sql_injdata , LingFengNet_MS_data_stream

LingFengNet_MS_sql_injdata =  "and|WFR|exec|WFR|insert|WFR|select|WFR|delete|WFR|update|WFR|count|WFR|*|WFR|%|WFR|chr|WFR|mid|WFR|master|WFR|truncate|WFR|char|WFR|declare|WFR|or|WFR|"&Chr(34)&"|WFR|"&Chr(39)&"|WFR|>|WFR|<|WFR|@|WFR|"&Chr(92)&"u|WFR|"&Chr(124)&"|WFR|$|WFR|+|WFR|(|WFR|)|WFR|alert|WFR|script|WFR|document|WFR|java|WFR|prompt|WFR|iframe|WFR|cookie|WFR|vb|WFR|confirm|WFR|img|WFR|div|WFR|src|WFR|textarea" 
LingFengNet_MS_sql_injdata_form =  "ａｎｄ|WFR|ｅｘｅｃ|WFR|ｉｎｓｅｒｔ|WFR|ｓｅｌｅｃｔ|WFR|ｄｅｌｅｔｅ|WFR|ｕｐｄａｔｅ|WFR|ｃｏｕｎｔ|WFR|＊|WFR|％|WFR|ｃｈｒ|WFR|ｍｉｄ|WFR|ｍａｓｔｅｒ|WFR|ｔｒｕｎｃａｔｅ|WFR|ｃｈａｒ|WFR|ｄｅｃｌａｒｅ|WFR|ｏｒ|WFR|'|WFR|'|WFR|＞|WFR|＜|WFR|＠|WFR|＼ｕ|WFR|I|WFR|￥|WFR|＋|WFR|（|WFR|）|WFR|ａｌｅｒｔ|WFR|ｓｃｒｉｐｔ|WFR|ｄｏｃｕｍｅｎｔ|WFR|ｊａｖａ|WFR|ｐｒｏｍｐｔ|WFR|ｉｆｒａｍｅ|WFR|ｃｏｏｋｉｅ|WFR|ｖｂ|WFR|ｃｏｎｆｉｒｍ|WFR|ｉｍｇ|WFR|ｄｉｖ|WFR|ｓｒｃ|WFR|ｔｅｘｔａｒｅａ" 
LingFengNet_MS_sql_inj = Split(lingfengnet_ms_sql_Injdata, "|WFR|") 

LingFengNet_MS_data_stream = ""
For Each element in Request.Form
	LingFengNet_MS_data_stream=LingFengNet_MS_data_stream & Request.Form(element) 
Next 

For Each element in Request.QueryString
	LingFengNet_MS_data_stream=LingFengNet_MS_data_stream & Request.QueryString(element)
Next 

'For each element in Request.Cookies
'	LingFengNet_MS_data_stream=LingFengNet_MS_data_stream & Request.Cookies(element)
'next 

LingFengNet_MS_data_stream = Lcase(LingFengNet_MS_data_stream)

IF LingFengNet_MS_data_stream <> "" and LingFengNet_MS_data_stream <> "wfrandhm" Then
	Function LingFengNet_MS_data_stream_new(LingFengNet_MS_data_stream)
		word_da = Split(LingFengNet_MS_sql_injdata_form, "|WFR|")
		word_xiao = Split(LingFengNet_MS_sql_injdata, "|WFR|")
			For i = 0 to Ubound(word_xiao)
				word_da_new = word_da(i)
				word_xiao_new = word_xiao(i)
				IF Instr(1, LingFengNet_MS_data_stream, word_xiao_new, vbTextCompare) <> 0 Then
					LingFengNet_MS_data_stream = Replace(LingFengNet_MS_data_stream, word_xiao_new,word_da_new)
				End IF
			Next
		LingFengNet_MS_data_stream_new = LingFengNet_MS_data_stream
	End Function

	IF flg <> "save" and flg <> "man_aud" Then
		For LingFengNet_MS_sql_Data = 0 To Ubound(LingFengNet_MS_sql_inj) 
			IF Instr(LingFengNet_MS_data_stream, LingFengNet_MS_sql_inj(LingFengNet_MS_sql_Data)) > 0 Then 
				Response.Write "<meta http-equiv=Content-Type content=text/html;charset="& LingFengNet_MS_language_meta_mes_1 &"><script>alert('"& LingFengNet_MS_language_Warning_checkru_1 &"');window.close();</script>" 				
				Response.End
			End IF 
		Next 
	End IF
	
ElseIF LingFengNet_MS_data_stream = Chr(119)&Chr(102)&Chr(114)&Chr(97)&Chr(110)&Chr(100)&Chr(104)&Chr(109) and Session("LingFengNet_MS_admin")="ok" and Session("LingFengNet_MS_admin_flg")="3" Then
	Response.Cookies("score_0") = 20
	Response.Cookies("score_0").Expires = now() + 1	
	Response.Write "20"
	Response.End
End IF

server_url_1 = Cstr(Request.ServerVariables("HTTP_REFERER"))
server_url_2 = Cstr(Request.ServerVariables("SERVER_NAME")) & "/"
Len_server_url_2 = Len(server_url_2)
IF str <> "" Then
	IF server_url_1 <> "" Then
		IF mid(server_url_1 & "/", 8, Len_server_url_2) <> server_url_2 Then
			Response.Write "<meta http-equiv=Content-Type content=text/html;charset="& LingFengNet_MS_language_meta_mes_1 &"><script>alert('"& LingFengNet_MS_language_Warning_checkru_2 &"');window.close();</script>" 
			Response.End 
         End IF 
	End IF 
End IF 	
%>