<%DB="/yanhan/20%#20%hanbindata.mdb"
Set conn = Server.CreateObject("ADODB.Connection")
connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(""&DB&"")
conn.Open connstr
Function FormatSQL(strChar)
if strChar="" then
FormatSQL=""
else
FormatSQL=replace(replace(replace(replace(replace(replace(replace(replace(strChar,"'","’"),"*","×"),"?","？"),"(","（"),")","）"),"<","〈"),".","。"),";","；")
end if
End Function
Function SafeRequest(ParaName,ParaType)
Dim ParaValue
ParaValue=FormatSQL(Request(ParaName))
If ParaType=1 then
If not isNumeric(ParaValue) then
Response.write "参数" & ParaName & "必须为数字型！"
Response.end
End if
Else
ParaValue=replace(ParaValue,"'","''")
End if
SafeRequest=ParaValue
End function
id=SafeRequest("id",1)
if request("typeid")="news" then
set rs=conn.execute("select top 10 id,[name],categoryid from product2 where sortsid=(select sortsid from product2 where id="&id&") order by addtime desc")
do while not rs.eof
Response.Write("document.write('·"&left(rs("name"),20)&"');")
rs.movenext
loop
rs.close
set rs=nothing
elseif request("typeid")="hot" then
set rs=conn.execute("select top 10 id,[name],categoryid from product2 where sortsid=(select sortsid from product2 where id="&id&") order by hits desc")
do while not rs.eof
Response.Write("document.write('·"&left(rs("name"),20)&"');")
rs.movenext
loop
rs.close
set rs=nothing
end if
%>