帮忙解asp的本机限制，谢谢
down了一个多用户asp的商城系统，在本机上测试，可是一打开就提示本机ip非法登入等信息，我查看了一下index.asp的代码，top上有个link，到conn.asp文件
<%
'请填写数据库具体参数
'------------------------------------------------------------
'-----------------------------------------------------------
dbpath=dbdns&"/shop/mycartconn/shopcom.asa" 'dbdns 为各文件中设置的路径，请不要改动
connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(""&dbpath&"")
'-----------------------------------------------------------
'打开数据库
response.buffer=true '启用缓冲处理
Set conn = Server.CreateObject("ADODB.Connection")
'conn.Open"Provider=sqloledb;user id="&SQLDBUserName&";password="&SQLDBPassword&";initial catalog="&SQLDBName&";data source="&SQLServerName&";"
conn.Open connstr
'防范未知IP访问及软件攻击
noip1 = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
noip2 = Request.ServerVariables("REMOTE_ADDR")
if noip1 = "" then
noip=noip2
else
noip=noip1
end if
if (noip1="unknown" or noip2="unknown") or (noip1="" and noip2="") then
Response.write "系统拒绝了你的来访IP不明访问请求，如有问题请与河南数据电子商务平台客服中心联系"
Response.end
end if
'SQL注入式攻击防范get及ID（not）代码
squery=lcase(Request.ServerVariables("QUERY_STRING"))
sURL=lcase(Request.ServerVariables("HTTP_HOST"))
allquery=squery+sURL
if InStr(allquery,"%20")<>0 or InStr(allquery," ")<>0 or InStr(allquery,"%27")<>0 or InStr(allquery,"'")<>0 or InStr(allquery,"%a1a1")<>0 or InStr(allquery," ")<>0 or InStr(allquery,"%24")<>0 or InStr(allquery,"$")<>0 or InStr(allquery,"%3b")<>0 or InStr(allquery,";")<>0 or InStr(allquery,":")<>0 or InStr(allquery,"%%")<>0 or InStr(allquery,"%3c")<>0 or InStr(allquery,"<")<>0 or InStr(allquery,">")<>0 or InStr(allquery,"--")<>0 or InStr(allquery,"sp_")<>0 or InStr(allquery,"xp_")<>0 or InStr(allquery,"exec")<>0 or InStr(allquery,"\")<>0 or InStr(allquery,"delete")<>0 or InStr(allquery,"dir")<>0 or InStr(allquery,"exe")<>0 or InStr(allquery,"select")<>0 or InStr(allquery,"Update")<>0 or InStr(allquery,"cmd")<>0 or InStr(allquery,"*")<>0 or InStr(allquery,"^")<>0 or InStr(allquery,"(")<>0 or InStr(allquery,")")<>0 or InStr(allquery,"+")<>0 or InStr(allquery,"copy")<>0 or InStr(allquery,"format")<>0 or not(isnumeric(request("userid"))) or not(isnumeric(request("id"))) or not(isnumeric(request("lbid"))) or not(isnumeric(request("xlbid"))) or not(isnumeric(request("cpid"))) or not(isnumeric(request("cp_id"))) or not(isnumeric(request("page"))) then
win=Request.ServerVariables("HTTP_USER_AGENT")
set rs = conn.execute("select js from nosql where ip='"&noip&"'")
if not rs.eof then
conn.execute("Update nosql set js=js+1 where ip='"&noip&"'")
'反击开绐(调用了一个死循环)
Response.write "<script language='JavaScript'>"
Response.write "while (true)"
Response.write "window.alert('非法入侵，你的IP及其它信息已被记录，系统已启动低级入侵自卫反击！！！')</script>"
Response.end
'反击结束
else
conn.execute("Insert into nosql(ip)values('"&noip&"')")
Response.Write("<script>alert(""错误提示：系统拒绝了你的不法访问，请确认你的访问的网址是否正确，如有问题请与网站客服中心联系！你的真实IP地址："&noip&"，所用游览器："&win&"。如果你的不法访问达到二次系统将自动进入初级入侵自卫反击状态。超过3次不法访问，系统将自动进入中高级入侵自卫反击状态。由此造成的一切后果自负！"");location.href=""/"";</script>")
Response.End
end if
rs.close
end if
'完了
'//在线总人：online_line，在线会员：online_huiyuan，在线游客：online_youke，最高在线：online_s
if Request.ServerVariables("HTTP_X_FORWARDED_FOR") = "" then
ip=Request.ServerVariables("REMOTE_ADDR")
else
ip= Request.ServerVariables("HTTP_X_FORWARDED_FOR")
end if
conn.execute("delete from online where datediff('n',sj,now())>1000")
if session("huiyuan")="" then
set jilu=conn.execute("select ip from online where ip='"&ip&"'")
if jilu.eof then
conn.execute("insert into online (ip,name)VALUES('"&ip&"','游客')")
else
conn.execute("update online set sj='"&now()&"' where ip='"&ip&"'")
end if
jilu.close:set jilu=nothing
else
set jilu=conn.execute("select name from online where name='"&replace(session("huiyuan"),"'","''")&"'")
if jilu.eof then
conn.execute("Delete from online where ip='"&ip&"'")
conn.execute("insert into online (name,ip,pic)VALUES('"&replace(session("huiyuan"),"'","''")&"','"&ip&"',1)")
else
conn.execute("update online set sj='"&now()&"' where name='"&replace(session("huiyuan"),"'","''")&"'")
end if
jilu.close:set jilu=nothing
end if
online_huiyuan=conn.execute("Select count(id)from online where pic=1")(0)
online_line=conn.execute("Select count(id)from online")(0)
if int(online_line)>int(online_s) then
online_s=online_line
end if
online_youke=online_line-online_huiyuan
'====================================================================
%>
<%
response.buffer=true
squery=lcase(Request.ServerVariables("QUERY_STRING"))
sURL=lcase(Request.ServerVariables("HTTP_HOST"))
allquery=squery+sURL
if InStr(allquery,"%20")<>0 or InStr(allquery," ")<>0 or InStr(allquery,"%27")<>0 or InStr(allquery,"'")<>0 or InStr(allquery,"%a1a1")<>0 or InStr(allquery," ")<>0 or InStr(allquery,"%24")<>0 or InStr(allquery,"$")<>0 or InStr(allquery,"%3b")<>0 or InStr(allquery,";")<>0 or InStr(allquery,"%%")<>0 or InStr(allquery,"%3c")<>0 or InStr(allquery,"<")<>0 or InStr(allquery,"%3e")<>0 or InStr(allquery,">")<>0 or InStr(allquery,"%28")<>0 or InStr(allquery,"(")<>0 or InStr(allquery,"%29")<>0 or InStr(allquery,")")<>0 or InStr(allquery,"%5c")<>0 or InStr(allquery,"\")<>0 then
response.write "非法访问"
Response.End
end if
Set conn = Server.CreateObject("ADODB.Connection")
'conn.ConnectionTimeout = 10 '设置connection对象连接数据库的逾期时间
'conn.CommandTimeout = 20 '设置执行execute方法时间
'conn.CursorLocation = 3 '将记录存放在游览器端
'打开数据库
response.buffer=true '启用缓冲处理
Set conn = Server.CreateObject("ADODB.Connection")
'conn.Open"Provider=sqloledb;user id="&SQLDBUserName&";password="&SQLDBPassword&";initial catalog="&SQLDBName&";data source="&SQLServerName&";"
conn.Open connstr
FUNCTION nohack(String)
dim noyes,nono
nono="'|\|;|(|)| |%20|<|>"
if not isnull(String) then
noyes = split(nono, "|")
for i = 0 to ubound(noyes)
String = Replace(String, noyes(i),"")
next
nohack = String
end if
END FUNCTION
%>
<%'post过滤sql注入代防范及HTML防护开始
function nosql(str)
if isnull(str) then
str = ""
exit function
end if
str=trim(str)
str=replace(str,"&","&") '&
str=replace(str,";",";") '分号
str=replace(str,"'","'") '单引号
str=replace(str,"""",""") '双引号
str=replace(str,"chr(9)"," ") '空格
str=replace(str,"chr(10)","<br>") '回车
str=replace(str,"chr(13)","<br>") '回车
str=replace(str,"chr(32)"," ") '空格
str=replace(str,"chr(34)",""") '双引号
str=replace(str,"chr(39)","'") '单引号
str=Replace(str, "script", "script")'script
str=replace(str,"<","<") '左<
str=replace(str,">",">") '右>
str=replace(str,"(","(") '左(
str=replace(str,")",")") '右)
str=replace(str,"*","*") '*
str=replace(str,"--","--") 'SQL注释符
nosql=str
end function%>
如何解除这样的限制？？？
本人不懂asp 哪位asp高手帮看看，解解。多多谢谢！！
平板模式
