<%DB="/yanhan/20%#20%hanbindata.mdb" Set conn = Server.CreateObject("ADODB.Connection") connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(""&DB&"") conn.Open connstr Function FormatSQL(strChar) if strChar="" then FormatSQL="" else FormatSQL=replace(replace(replace(replace(replace(replace(replace(replace(strChar,"'","’"),"*","×"),"?","？"),"(","（"),")","）"),"<","〈"),".","。"),";","；") end if End Function Function SafeRequest(ParaName,ParaType) Dim ParaValue ParaValue=FormatSQL(Request(ParaName)) If ParaType=1 then If not isNumeric(ParaValue) then Response.write "参数" & ParaName & "必须为数字型！" Response.end End if Else ParaValue=replace(ParaValue,"'","''") End if SafeRequest=ParaValue End function id=SafeRequest("id",1) if request("hitstype")="news" then conn.execute("update news set viewnum=viewnum+1 where newsid="&id) set rs=conn.execute("select viewnum from news where newsid="&id) if not rs.eof then Response.Write("document.write('"& rs(0) & "')") end if elseif request("hitstype")="product" then conn.execute("update product2 set hits=hits+1 where id="&id) set rs=conn.execute("select hits from product2 where id="&id) if not rs.eof then Response.Write("document.write('"& rs(0) & "')") end if end if %>