给日志评论增加回复功能for pjblog (4/5凌晨更新,修改越权提交的BUG,危险)

                                        <div class="content"><textarea name="message_<%=commArr(0,Pcount)%>" onFocus="focusMe(this)" onBlur="blurMe(this)" onMouseOver="overMe(this)" onMouseOut="outMe(this)"><%=UnCheckStr(commArr(1,Pcount))%></textarea></div>

                                        <div class="reply"><h5>回复内容:<%if len(trim(commArr(7,Pcount)))<1 or IsNull(commArr(7,Pcount)) then response.write "<span class=""tip"">(无回复留言)</span>"%></h5><textarea name="reply_<%=commArr(0,Pcount)%>" onFocus="focusMe(this)" onBlur="blurMe(this)" onMouseOver="overMe(this)" onMouseOut="outMe(this)" onChange="checkMe(this)"><%=UnCheckStr(commArr(7,Pcount))%></textarea></div>

                            SQL="Select comm_ID,comm_Content,comm_Author,comm_PostTime,comm_PostIP,blog_ID,T.log_Title from blog_Comment C,blog_Content T Where C.blog_ID=T.log_ID orDER BY C.comm_PostTime desc"

                            SQL="Select comm_ID,comm_Content,comm_Author,comm_PostTime,comm_PostIP,blog_ID,T.log_Title,comm_Reply from blog_Comment C,blog_Content T Where C.blog_ID=T.log_ID orDER BY C.comm_PostTime desc"

elseif  Request.form("doModule")="Update" then
             for i=0 to ubound(doCommID)
                if Request.form("whatdo")="msg" then

doTitle="评论"
                        doRedirect=""
                end if
             next

                        dim blog_book_reply
                        set blog_book_reply=Conn.Execute("select book_reply FROM blog_book Where book_ID="&doCommID(i))
                        if blog_book_reply("book_reply")=checkStr(Request.form("reply_"&doCommID(i))) then
                                conn.execute("Update blog_book SET book_Content='"&checkStr(Request.form("message_"&doCommID(i)))&"',book_replyAuthor='"&memName&"' Where book_ID="&doCommID(i))
                        else
                                conn.execute("Update blog_book SET book_Content='"&checkStr(Request.form("message_"&doCommID(i)))&"',book_replyAuthor='"&memName&"',book_replyTime=#"&DateToStr(now(),"Y-m-d H:I:S")&"#,book_reply='"&checkStr(Request.form("reply_"&doCommID(i)))&"' Where book_ID="&doCommID(i))
                        end if
                        doTitle="留言"
                        doRedirect="msg"
                elseif Request.form("whatdo")="comment" then
                          dim blogcommid
                          set blogcommid=Conn.ExeCute("select comm_Reply from blog_Comment where comm_ID="&doCommID(i))
                          if blogcommid("comm_Reply")=checkStr(Request.form("reply_"&doCommID(i))) then
                                conn.execute("Update blog_Comment SET comm_Content='"&checkStr(Request.form("message_"&doCommID(i)))&"' Where comm_ID="&doCommID(i))
                        else
                                conn.execute("Update blog_Comment SET comm_Content='"&checkStr(Request.form("message_"&doCommID(i)))&"',comm_Reply='"&checkStr(Request.form("reply_"&doCommID(i)))&"',Comm_replytime=#"&DateToStr(now(),"Y-m-d H:I:S")&"# Where comm_ID="&doCommID(i))
                        end if