%
id=Request.Querystring("id")
If id ="" then
Response.Write("")
end if
if instr(id,"'") or instr(id,"select") or instr(id,"in") or instr(id,"from") or instr(id,"len") or instr(id,"where") or instr(id,"or") or instr(id,"and") then
Response.Write("")
Response.End
end if 'delete TMD chars
conn.execute("update imgbook set click=click+1 where ID=" & id)
sql="select * from imgbook where ID="&id
set rs=server.createobject("adodb.recordset")
rs.open sql,conn,1,1
if rs.eof then
Response.Write("Sorry, no such a picture£¡")
Response.end
end if
%>
Sirius Industry - <%=rs("title")%>
SIRIUS:: Model <%=rs("title")%>
Popularity Index: <%=rs("click")%>
Model No.: <%=rs("title")%>
<%
img=rs("news_content")
if instr(img,"[img]") then
img = Replace(img, "[img]","")
else
img = Replace(img, "[uploadimg]","")
end if
Response.Write(img)
%>
Product Description :
<%=ubbcode(rs("guestcontent"))%>
<%
rsclose()
set rs1=server.CreateObject("Adodb.recordset")
sql1="select ID from imgbook where ID="&Request.Querystring("id")+1
rs1.open sql1,conn,1,1
if not rs1.bof then
Response.Write("Previous Product ")
end if
rs1.close
sql1="select ID from imgbook where ID="&Request.Querystring("id")-1
rs1.open sql1,conn,1,1
if not rs1.bof then
Response.Write("Next Product ")
end if
rs1.close
set rs1=nothing
%>