小弟不才，编写了一段代码居然错误了，还请高手指点
网页显示错误：
Microsoft VBScript 编译器错误 '800a0409'
未结束的字符串常量
\gee\conn.asp, line 12
下面是conn.asp的代码
<%
response.buffer = True '启用缓冲处理
Dim conn, db
Dim connstr
db = "&&da#te#&/##dzdq&date#.mdb" '数据库链接路径
connstr = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(db)
Set conn = server.CreateObject("ADODB.CONNECTION")
conn.Open connstr
If Err Then
Err.Clear
Set Conn = Nothing
Response.Write "数据库连接出错，请检查数据库连接文件中的数据库参数设置。"
Response.End
End If
Sub Chkhttp()
server_vv = Len(Request.ServerVariables("SERVER_NAME"))
server_v1 = Left(CStr(Request.ServerVariables("HTTP_REFERER")), server_vv)
server_v2 = Left(CStr("http://"&Request.ServerVariables("SERVER_NAME")), server_vv)
If server_v1<>server_v2 Or server_v1 = "" Or server_v1 = "" Then
response.Charset = "utf-8"
response.Write("<script>alert('错误：禁止从站点外部提交数据!.')</script>")
response.End
End If
End Sub
%>
<%
Set site_info = server.CreateObject("adodb.recordset")
exec = "select * from site_info"
site_info.Open exec, conn, 1, 1
%>
<%
Dim GetFlag Rem(提交方式)
Dim ErrorSql Rem(非法字符)
Dim RequestKey Rem(提交数据)
Dim ForI Rem(循环标记)
ErrorSql = "'~;~and~(~)~exec~update~count~*~%~<~>~chr~mid~master~truncate~char~declare" Rem(每个敏感字符或者词语请使用半角 "~" 格开)
ErrorSql = Split(ErrorSql, "~")
If Request.ServerVariables("REQUEST_METHOD") = "GET" Then
GetFlag = True
Else
GetFlag = False
End If
If GetFlag Then
For Each RequestKey In Request.QueryString
For ForI = 0 To UBound(ErrorSql)
If InStr(LCase(Request.QueryString(RequestKey)), ErrorSql(ForI))<>0 Then
response.Write "<script>alert(""警告:\n请不要使用特殊字符\n比如英文的单引号’"");history.go(-1);</script>"
Response.End
End If
Next
Next
Else
For Each RequestKey In Request.Form
For ForI = 0 To UBound(ErrorSql)
If InStr(LCase(Request.Form(RequestKey)), ErrorSql(ForI))<>0 Then
response.Write "<script>alert(""警告:\n请不要使用特殊字符\n比如英文的单引号’"");history.go(-1);</script>"
Response.End
End If
Next
Next
End If
%>
<%
Sql_in = "and |or |on |in |select |insert |update |delete |exec |declare |'"
'防止GET方法--------------------------------------------------------
'区分出注入字符
Sql = Split(Sql_in, "|")
'如果GET过来的数据不为空
If Request.QueryString<>"" Then
'逐一取出提交过来的参数
For Each Sql_Get In Request.QueryString
For Sql_Data = 0 To UBound(Sql)
'判断是否包含非法字符
If InStr(LCase(Request.QueryString(Sql_Get)), Sql(Sql_Data))<>0 Then
'如果有非法字符，弹出对话框提示，并自动返回上一页
Response.Write("<script>alert('系统提示：请不要输入非法字符尝试注入↓，你的IP已记录!');history.go(-1);</script>")
Response.End()
End If
Next
Next
End If
'防止POST方法---------------------------------------------------
If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For Sql_Data = 0 To UBound(Sql)
If InStr(LCase(Request.Form(Sql_Post)), Sql(Sql_Data))<>0 Then
Response.Write("<script>alert('系统提示：请不要输入非法字符尝试注入↓你的IP已记录!');history.go(-1);</script>")
Response.End()
End If
Next
Next
End If
'-----------------------------------------------------------
%>