ASP VBSCRIPT

<% Set rs = Server.CreateObject("ADODB.Recordset") ' 拼接时要对 ' 转义 sql = "select * from usermessage where username='" & Replace(Request.Form("user"), "'", "''") & "'&q