<%DB="/yanhan/20%#20%hanbindata.mdb" Set conn = Server.CreateObject("ADODB.Connection") connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(""&DB&"") conn.Open connstr Function FormatSQL(strChar) if strChar="" then FormatSQL="" else FormatSQL=replace(replace(replace(replace(replace(replace(replace(replace(strChar,"'","’"),"*","×"),"?","？"),"(","（"),")","）"),"<","〈"),".","。"),";","；") end if End Function Function SafeRequest(ParaName,ParaType) Dim ParaValue ParaValue=FormatSQL(Request(ParaName)) If ParaType=1 then If not isNumeric(ParaValue) then Response.write "参数" & ParaName & "必须为数字型！" Response.end End if Else ParaValue=replace(ParaValue,"'","''") End if SafeRequest=ParaValue End function set rs=conn.execute("select top 2 id,[name],categoryid from product2 where sortsid=188 order by hits desc") Response.Write("document.write( '

');") do while not rs.eof Response.Write("document.write( '·"&left(rs("name"),20)&"  ');") rs.movenext loop Response.Write("document.write( '

');") rs.close set rs=nothing %>