<%@language=vbscript codepage=936%>
<%path="basedata"%>
<!--#include file="inc/function.asp"-->
<!--#include file="conn/conn_admin.asp"-->
<!--#include file="inc/config.asp"-->
<%
'<!--#include file="md5.asp"-->
dim sql,rs
dim username,password,CheckCode,setcookie

	username=replace(replace(replace(trim(request.form("username")),"'",""),"or",""),"and","")
	password=replace(replace(replace(trim(Request.form("password")),"'",""),"or",""),"and","")
	CheckCode=replace(trim(Request.form("CheckCode")),"'","")
	setcookie=trim(Request.form("setcookie"))

	if session("CheckCode")="" then
	response.write msgok("你等待时间过长,请重新返回登录页面进行登录!;","login.asp")
	response.end
	elseif UserName="" then
	response.write	errorback("用户名不能为空!")
	response.end
	elseif Password="" then
	response.write errorback("密码不能为空!")
	response.end
	elseif CheckCode="" then
	response.write errorback("验证码不能为空!")
	response.end
	end if


	if ucase(CheckCode)<>ucase(CStr(session("CheckCode"))) then
	response.write msgok("您输入的确认码和系统产生的不一致,请重新输入!;","login.asp")
	response.end
	else
                                                                           password_md5=md5(md5(password))
	sql="Select * from Admin where admin_user='"&username&"' and admin_pass='"&password_md5&"'"
	set rs=server.createobject("adodb.recordset")
	rs.open sql,conn_admin,2,3

		if rs.bof and rs.eof then
		rs.close
		set rs=nothing
		conn_admin.close
		set conn_admin=nothing
		response.write msgok("你输入的用户名或密码错误!!!","login.asp")
		response.end
		else
			IP=Request.ServerVariables("HTTP_X_FORWARDED_FOR") '如果客户端使用了代理服务器,得到真正IP地址
			If IP = "" Then IP=Request.ServerVariables("REMOTE_ADDR") '如果没用使用代理服务器,得到真正IP地址
			info=request.servervariables("http_user_agent") '得到用户HTTP设备的变量,如:你使用的IE浏览器版本,还有你的机器名和操作系统

		    if rs("admin_login_numeric")<>"" or rs("admin_login_numeric")<>null then
		    sum=1+rs("admin_login_numeric")
		    else
		    sum=1
		    end if

				session.Timeout=SessionTimeout
				session("LastLoginIP")=rs("admin_last_login_ip")
		   		session("LastLoginTime")=rs("admin_last_login_time")
				session("AdminName")=rs("admin_user")
				session("AdminPassword")=rs("Admin_Pass")
				if rs("admin_flag") then
				session("masterflag")=true
				else
				session("masterflag")=false
				end if
		   		session("sum")=sum
		   		if setcookie="yes" then
		   		response.cookies("name")=username
		   		response.cookies("pwd")=md5(now())&strreverse(md5(password))&md5(now()&"456vv")
		   		else
		   		response.cookies("name")=""
		   		response.cookies("pwd")=""
		   		end if
				rs("admin_last_login_ip")=IP
				rs("admin_last_login_agent")=info
				rs("admin_last_login_time")= now()
				rs("admin_login_numeric")=sum
				rs.update
        rs.close
        set rs=nothing
        conn_admin.close
        set conn_admin=nothing
				Response.Redirect "index.asp"'登陆成功转管理页面
		end if
	end if


%>
