Bbsxp 2007斑竹权限注射

if Request.ServerVariables("Request_method") = "POST" then

select case Request.Form("Item")
case "BatchDel"
IsDel=Request.Form("IsDel")
for each ho in Request.Form("ThreadID")
ho=int(ho)
Conn.execute("update [BBSXP_Threads] set IsDel="&IsDel&",lasttime="&SqlNowString&",lastname='"&CookieUserName&"' where ThreadID="&ho&ForumSql&"")
next

succtitle="批量删除，主题ID："&Request.Form("ThreadID")&""