<%@ Language=VBScript %>
<% Option Explicit %>
<% '디비 커넥션 %>
<% '/디비 커넥션 %>
<%
dim str,val ' 해피정닷컴 추가 2008-05-27
function sqlCheck(str)
val=UCASE(str)
if instr(val, ";") <> 0 Or _
instr(val, "'") <> 0 Or _
instr(val, "--") <> 0 Or _
instr(val, "/*") <> 0 Or _
instr(val, "*/") <> 0 Or _
instr(val, "XP_") <> 0 Or _
instr(val, "DECLARE") <> 0 Or _
instr(val, "SELECT") <> 0 Or _
instr(val, "UPDATE") <> 0 Or _
instr(val, "DELETE") <> 0 Or _
instr(val, "INSERT") <> 0 Or _
instr(val, "SHUTDOWN") <> 0 Or _
instr(val, "DROP") <> 0 then
' response.write "오류발생"
response.Write("")
response.End
Else
sqlCheck=str
end if
end function
'Dim idx : idx=sqlCheck(request("idx"))
'변수 선언
Dim NewGetTable,GetPage, GetSeq, GetId, GetSearchPart, GetSearchStr
Dim C_id, file_name, fc, storedir
NewGetTable = "mechBoard"
GetSeq = sqlCheck(request("seq"))
GetPage = sqlCheck(request("page"))
GetSearchPart = sqlCheck(request("SearchPart"))
GetSearchStr = sqlCheck(request("SearchStr"))
'C_id = Request.Cookies("USER")("C_id")
'C_passwd = Request.Cookies("USER")("C_pw")
Dim GetBD_PASSWD, GetBD_PASSWD2
GetBD_PASSWD= sqlCheck(request("formBD_PASSWD")) ' 기존 비밀번호
GetBD_PASSWD2= sqlCheck(request("formDelPasswd")) ' 새로입력한 비밀번호
if session("admin") = "administrator" or GetBD_PASSWD = GetBD_PASSWD2 then
' 비밀번호 확인 end if 는 마지막 에 위치
if GetPage = "" then GetPage = 1
' 관리자로그인후 삭제할때는 이상없는데... 비로그인일때는 왜 아래에서 and 키워드 근처의 구문이 잘못되었다... 라고 할까?
Sql = "select FILE_NAME from " & NewGetTable & "_PDS where FILE_BD_SEQ = " & GetSeq & " and FILE_BD_TABLE = '" & NewGetTable & "'"
Set Rs = Con.Execute(Sql)
if not (rs.BOF or rs.EOF) then
file_name = Rs(0)
end if
'******************** 게시글 삭제
Sql = "delete from " & NewGetTable & " where BD_SEQ = " & GetSeq
Con.Execute(Sql)
if not file_name = "" then
'******************** 파일 삭제
Sql = "delete from " & NewGetTable & "_PDS where FILE_BD_SEQ = " & GetSeq & " and FILE_BD_TABLE = '" & NewGetTable & "'"
Con.Execute(Sql)
set fc = CreateObject("Scripting.FileSystemObject")
storedir = server.mappath("../..") & "\upload\news\"
fc.DeleteFile(storedir & file_name)
set fc=nothing
end if
Rs.close
set rs = nothing
con.close
set con= nothing
'페이지 이동
Response.Redirect "news.asp?page=" & GetPage & "&SearchPart=" & GetSearchPart & "&SearchStr=" & GetSearchStr
' 비밀번호 일치 확인
else
Response.Write("")
' 비밀번호 확인 종료
end if
%>