Dim s,k,p,page,all,i,info,maxperpage
s=Request("s")
k=Request("k")
p=cint(Request("p"))
maxperpage=10
if k="" then
response.write"<SCRIPT language=JavaScript>alert('请输入关键字!');"
response.write"javascript:history.back(1);</SCRIPT>"
response.end
End if
if p="" then p=1
if p=0 then p=1
checkid(p)
if s<>"" then checkid(s) ||过滤了s。checkid函数 检测是否为数字
if s<>"" then
Sql="Select html,Title,Info,Inputdate from A_Info where tid="&s&" and title like '%"&k&"%'" ||很明显。没有过滤k 直接带进数据库查询
else
Sql="Select html,Title,Info,Inputdate from A_Info where title like '%"&k&"%'" ||同上
end if
set rs=server.CreateObject("ADODB.RecordSet")
rs.open sql,conn,1,1
if rs.eof then
Response.Write "没有到任何数据，请重新设置关键字"
Response.End
Else
rs.pagesize=maxperpage '得到每页数
page=rs.pagecount '得到总页数
all=rs.recordcount
if p<page then
rs.move (p-1)*maxperpage
end if
i=0
