对网软网上购物系统的漏洞分析

sql="select * from sms"
set rs=server.createobject("adodb.recordset")
rs.open sql,conn,1,3
rs.addnew
rs("name")="admin"
neirong=request.form("neirong") ///入库的时候没有过滤
neirong=replace(neirong,"=======","<font color=darkgray>======")
rs("neirong")=neirong
rs("riqi")=now()
rs("fname")=request.cookies("cnhww")("username")
rs.update
rs.close
set rs=nothing

response.write "<script language='javascript'>"
response.write "alert('操作成功，已向管理员发送一条站内消息！');"
response.write "location.href='user.asp?action=famess';"
response.write "</script>"
response.end

conn.close
set conn=nothing

set rs=Server.CreateObject("ADODB.recordset")
sql="select * from sms where (name='管理员' or name='admin') and zuti='0' order by riqi desc"
rs.open sql,conn,1,3

if rs.eof and rs.bof then
response.write "<tr><td>收件箱中没有消息。</td></tr>"
else

．．．．．．中间省略．．．．．．．．．．．．

do while not rs.eof and pages>0
neirong=rs("neirong")
riqi=rs("riqi")
isnew=rs("isnew")
fname=rs("fname")
id=rs("id")
if pages<10 then response.write "<tr><td height=15></td></tr>"
%>

．．．．．．中间省略．．．．．．．．．．．．
<hr color=#e7e7e7><BR>
<%=replace(neirong,vbCRLF,"<BR>")%><br>&nbsp;
</td></tr>