<!--#include file="md5.asp"-->
<%
	'------------登陆---------------------
	sub Loginpower
		if session("AdminName") = "" then
		%>
		<!--#include file="../conn/conn_admin.asp"-->
		<%
		dim name_a,pwd_a
		name_a=replace(replace(replace(trim(Request.cookies("name")),"'",""),"or",""),"and","")
		pwd_a=replace(replace(replace(trim(Request.cookies("pwd")),"'",""),"or",""),"and","")
			if name_a<>"" and pwd_a<>"" then
			                                                 						pwd_a=md5(strreverse(mid(pwd_a,17,16)))
			sql="Select * from Admin where admin_user='"&name_a&"' and admin_pass='"&pwd_a&"'"
			set rs=server.createobject("adodb.recordset")
			rs.open sql,conn_admin,2,3
			
				if rs.bof and rs.eof then
				rs.close
				set rs=nothing
				conn_admin.close
				set conn_admin=nothing
				response.write msgok("cookies错误!!!","../login.asp")
				response.end
				else
					IP=Request.ServerVariables("HTTP_X_FORWARDED_FOR") '如果客户端使用了代理服务器,得到真正IP地址
					If IP = "" Then IP=Request.ServerVariables("REMOTE_ADDR") '如果没用使用代理服务器,得到真正IP地址
					info=request.servervariables("http_user_agent") '得到用户HTTP设备的变量,如:你使用的IE浏览器版本,还有你的机器名和操作系统
						session.Timeout=SessionTimeout
						session("LastLoginIP")=rs("admin_last_login_ip")
				   		session("LastLoginTime")=rs("admin_last_login_time")
						session("AdminName")=rs("admin_user")
						session("AdminPassword")=rs("Admin_Pass")
				   		session("sum")=rs("admin_login_numeric")
						if rs("admin_flag") then
						session("masterflag")=true
						else
						session("masterflag")=false
						end if
		        rs.close
		        set rs=nothing
		        conn_admin.close
		        set conn_admin=nothing
				end if
			else
			    response.Redirect "../Login.asp"
			    response.end
			end if
		end if
	end sub
	'--------------权限----------------------
	sub Legalpower
	 if session("masterflag")<>true or session("masterflag")="" or isnull(session("masterflag"))  then
		 response.write errorback("你没有权限管理啊！")
	 	response.end
	 end if
	end sub

	function idboolean(id)
	idboolean=false
	if isnumeric(id) and not isnull(id) and id<>"" then idboolean=true
	end function

	function errorback(str)
	errorback="<script language=""JavaScript"">alert("""&str&""");window.history.back();</script>"
	end function
	function msgok(str,url)
	msgok="<script language=""JavaScript"">alert("""&str&""");window.location.href="""&url&""";</script>"
	end function
'-----------------------------------------
'*******************************
'文件名：
'描  述：使用正则表达式验证content
'*******************************
Function Validate(patrn,str)'"iframe*|script*"
	Dim regEx
	Set regEx = new RegExp
	regEx.IgnoreCase = true
	regEx.global = true
	regEx.Pattern = patrn
	if regEx.Test(str) then
		Validate = true
	else
		Validate = false
	end if
	set regEx = Nothing
End Function
'--------------------------------HTMLDecode
Function HTMLDecode(reString)
	Dim Str:Str=reString
	If Not IsNull(Str) Then
		Str = Replace(Str, "&gt;", ">")
		Str = Replace(Str, "&lt;", "<")
		Str = Replace(Str, "&nbsp;", CHR(32))
		Str = Replace(Str, "&amp;", "&")
	    'Str = Replace(Str, "&nbsp;", CHR(9))
		Str = Replace(Str, "&#160;&#160;&#160;&#160;", CHR(9))
		'Str = Replace(Str, "&quot;", CHR(34))
		Str = Replace(Str, "&#39;", CHR(39))
		HTMLDecode = Str
	End If
End Function
'--------------------------------codeDeHTML
function codedeHTML(reString)
	Dim Str:Str=reString
	If Not IsNull(Str) Then
	'Str = Replace(Str, "&", "&amp;")
    Str = replace(Str, ">", "&gt;")
    Str = replace(Str, "<", "&lt;")
    Str = Replace(Str, CHR(32), "&nbsp;")
    Str = Replace(Str, CHR(9), "&nbsp;")
    Str = Replace(Str, CHR(34), "&quot;")
    Str = Replace(Str, CHR(39), "&#39;")
    codedeHTML =Str
    end if
end function

 '--------SQL防注入定义部份------------------
Dim Fy_Post,Fy_Get,Fy_In,Fy_Inf,Fy_Xh
Fy_In = "*|%|and|or|join|union|like|modify|cast|drop|exec|insert|select|delete|update|count|alter|rename|chr|mid|truncate|char|asc|declare|'|=|>|<"
Fy_Inf = split(Fy_In,"|")
'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString
For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
Response.Write errorback("你好，你提交的信息，有非法[字母]......")
Response.End
End If
Next
Next
End If

'Fypost_In = "and|or|join|union|like|modify|cast|drop|exec|insert|select|delete|update|count|alter|rename|chr|mid|truncate|char|asc|declare|'"
'Fypost_Inf = split(Fypost_In,"|") 
'--------POST部份------------------
'If Request.Form<>"" Then
'For Each Fy_Post In Request.Form
'For Fypost_Xh=0 To Ubound(Fypost_Inf) '5
'If Instr(LCase(Request.Form(Fy_Post)),Fypost_Inf(Fypost_Xh))<>0 Then
'Response.Write errorback("你好，你提交的信息，有非法[字母]......")
'Response.End
'End If
'Next
'Next
'End If
'--------SQL防注入定义部份------------------
%>