Function NoCSSHack(Str)     ’过滤非法字符

 Dim regEx

 Set regEx = New RegExp

 regEx.IgnoreCase = True

 regEx.Pattern = "<|>|(ｓｃｒｉｐｔ)|on(mouseover|mouseon|mouseout|click|dblclick|blur|focus|change)|src|’|img|url|eval|\t"

 If regEx.Test(LCase(Str)) Then

  Response.Write "<ｓｃｒｉｐｔ>ａｌｅｒｔ(’你的输入含有非法字符，请检查后再搜索！’);history.back();</ｓｃｒｉｐｔ>"

  Response.End

 End If

 Set regEx = Nothing

 NoCSSHack = Str

End Function

Function FormatHTML(fString)     ’去除空格

If fString<>"" Then 

fString = trim(fString)

fString = Replace(fString,"　","")

fString = Replace(fString," ","")

FormatHTML = fString

End If 

End Function

str=NoCSSHack(left(FormatHTML(Server.HTMLEnCode(request("q"))),20))    ’截取前面20个字符，搜索关键词参数为q

if str="" then

response.write "请输入关键词！"

else

set rs=server.createobject("adodb.recordset")

for i=1 to len(str)

if len(str)<>i then

sql=sql&"标题字段 not like ’%"&str&"%’ ａｎｄ 标题字段 like ’%"&mid(str,i,2)&"%’ or "

else

sql=sql&"内容字段 like ’%"&str&"%’"

end if

next

sql="ｓｅｌｅｃｔ * ,1 from [数据表] where 标题字段 like ’%"&str&"%’ union ｓｅｌｅｃｔ * ,2 from [数据表] where "&sql&""

rs.open sql,conn,1,1

if rs.eof then

response.write "没有搜索到内容！"

else

do while not rs.eof

response.write "............输出省略............"

rs.movenext

loop

end if

rs.close

end if