<%@LANGUAGE="VBSCRIPT"%>
<%response.buffer=true%>
<%
'WinMyDNS数据库链接参数,请在这里手工修改
'##############################################################################################
WinMyDNSDbType="1"			'数据为类型,0:Access,1:mssql数据库
WInMyDNSAccessFile="../DB/WinMyDNS.MDB"	'Access数据库文件名
WinMyDNSDbIP = "127.0.0.1"		' 数据库IP地址
WinMyDNSDbName="WinMydns"		' 数据库名
WinMyDNSDbUser="sa"			' 数据库用户名
WinMyDNSDbPass="111111"			' 数据库密码
'##############################################################################################
PageCount = "100"
Set conn = Server.CreateObject("ADODB.Connection")
if WinMyDNSDbType ="1" then
connstr="Provider=SQLOLEDB.1; Persist Security Info=True; Data Source="&WinMyDNSDbIP&"; Initial Catalog="&WinMyDNSDbName&"; User ID="&WinMyDNSDbUser&"; Password="&WinMyDNSDbPass
else
connstr="DBQ="+Server.Mappath(WInMyDNSAccessFile)+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
end if
conn.Open connstr

SQL_injdata = "'|exec |insert |select |update |delete |set |xp_cmdshell |exec master|xp_dirtree |exec master |char |net localgroup administrators | and |net user | or |mid( |asc( |truncate " 
SQL_inj = split(SQL_Injdata,"|") 
If Request.QueryString<>"" Then 
	For Each SQL_Get In Request.QueryString 
		For SQL_Data=0 To Ubound(SQL_inj) 
			if instr(lcase(Request.QueryString(SQL_Get)),Sql_Inj(Sql_DATA))>0  Then 
				response.write "输入非法"
				Response.end 
			end if 
		next 
	Next 
End If 
If Request.Form<>"" Then 
	For Each Sql_Post In Request.Form 
		For SQL_Data=0 To Ubound(SQL_inj) 
			if instr(lcase(Request.Form(Sql_Post)),Sql_Inj(Sql_DATA))>0 Then 
				response.write "输入非法"
				Response.end 
			end if 
		next 
	next 
end if

'SQL防入库函数
Function SafeRequest(ParaName) 
	Dim ParaValue 
	ParaValue=request(ParaName)
	if ParaValue = "" then
		SafeRequest = ""
		exit function
	end if
	'过虑非法字符	
	ParaValue = replace(ParaValue,"'","")
	ParaValue = replace(ParaValue,"select ","")
	ParaValue = replace(ParaValue,"insert ","")
	ParaValue = replace(ParaValue,"delete ","")
	ParaValue = replace(ParaValue,"count(","")
	ParaValue = replace(ParaValue,"drop table ","")
	ParaValue = replace(ParaValue,"update ","")
	ParaValue = replace(ParaValue,"truncate ","")
	ParaValue = replace(ParaValue,"asc(","")
	ParaValue = replace(ParaValue,"mid(","")
	ParaValue = replace(ParaValue,"char(","")      
	ParaValue = replace(ParaValue,"xp_cmdshell","")
	ParaValue = replace(ParaValue,"exec master","")
	ParaValue = replace(ParaValue,"net localgroup administrators","")
	ParaValue = replace(ParaValue," and ","")
	ParaValue = replace(ParaValue,"net user","")
	ParaValue = replace(ParaValue," or ","")
	SafeRequest=ParaValue
End function

'=====================================================
'输入参数：
'	username,password,domain,ttl(用户名,密码,域名,TTL)
'	其中domain:以","号分隔的域名
'输出:
'	ocode:0=成功,-1=失败
'	omesg:提示说明
'	ip:域名指向的IP
'=====================================================

Function BackMess(OCode,OMesg)
  Response.Write "ocode="&OCode&vbCrLf
  Response.write "omesg="&OMesg&vbCrLf
  Response.write "ip="&IP&vbCrLf
  Response.End
End Function

UserName = SafeRequest("username")
Password = SafeRequest("password")
Domain   = SafeRequest("domain")
TTL      = SafeRequest("ttl")
Ip       = Request.ServerVariables("REMOTE_ADDR")
If TTL="" or Not IsNumeric(TTL) Then TTL=180

'======================
'用户名,密码判断
'======================
'If UserName="" or Password="" or Domain="" Then Call BackMess(-1,"Information missing")
If UserName="" Then Call BackMess(-1,"username missing")
If Password="" Then Call BackMess(-1,"password missing")
If Domain="" Then Call BackMess(-1,"domain missing")


Sql    = "Select username,password from [UserList] where username='"&UserName&"'"
Set Rs = Conn.Execute(sql)
If Rs.Eof Then Call BackMess(-1,"username wrong")
If Rs("password")<>Password Then Call BackMess(-1,"password wrong")
Ruser=Rs("username")
Set Rs=Nothing

'======================
'用户权限判断
'======================
Sql    = "Select id,origin from [SOA] where username='"&Ruser&"'"
Set Rs = Conn.Execute(sql)
OKdns=""
For Each str in split(domain,",")
  'Response.Write str&"<br>"&vbCrLf
  Do While Not Rs.Eof
    If str&"."=Rs("origin") Then '对相应域名有操作权限
      Sql="Select * from [RR] where zone="&Rs("id")&" and type='A'"
      Set SRs=Server.createobject("ADODB.RecordSet") 
      SRs.open Sql,conn,1,3
      If Not SRs.Eof Then	'存在对应的DNS记录=>更新相关A记录
	    Do While Not SRs.Eof
	      SRs("data")=Ip
	      SRs("ttl")=TTL
	      SRs.Update   
	      SRs.MoveNext     
	    Loop
      Else      		'不存在=>添加一条A记录泛解析
        Conn.Execute("Insert Into [RR] (zone,name,type,data,aux,ttl) VALUES ("&Rs("id")&",'*','A','"&IP&"',10,"&TTL&")")
      End If
      Set SRs=Nothing
      Sql="Update [SOA] Set serial=serial+1 where username='"&Ruser&"'"
      Conn.Execute(sql)
      OKdns=OKdns&str&" "
    End If
    Rs.MoveNext 
  Loop
  Rs.MoveFirst
Next
If OKdns="" Then Call BackMess(-1,"Null domain done")
Call BackMess(0,OKdns&"operation ok")
%>