来源：Loveshell

moderation.asp中的这些代码

if Request.ServerVariables("Request_method") = "POST" then

select case Request.Form("Item")
  case "BatchDel"
    IsDel=Request.Form("IsDel")
    for each ho in Request.Form("ThreadID")
      ho=int(ho)
      Conn.execute("update [BBSXP_Threads] set IsDel="&IsDel&",lasttime="&SqlNowString&",lastname='"&CookieUserName&"' where ThreadID="&ho&ForumSql&"")
    next
 
    succtitle="批量删除，主题ID："&Request.Form("ThreadID")&""

IsDel=Request.Form("IsDel")这句是完全信任的,所以不说了呵~~~~~~~
我够无聊的唉,我承认我是搜=request.来的,这个是bbsxp没过滤的特征 :)