<!--#include file="chkpass.asp" -->
<!-- #Include File=inc/prompt.inc -->
<!-- #Include File=conn.asp-->
<%
dim username,password,password2,password3,successmess,backurl,founderr,rs,tt
username=trim(replace(request("username"),"'",""))
password=trim(replace(request("password"),"'",""))
password2=trim(replace(request("password2"),"'",""))
password3=trim(replace(request("password3"),"'",""))

if username="" or Len(username)>20 then
	errmsg=errmsg+"<br>"+"<li>请输入您的用户名(长度不能大于20)!"
	founderr=true
	else
	username=username
end if

if Instr(request("username"),"=")>0 or Instr(request("username"),"%")>0 or Instr(request("username"),chr(32))>0 or Instr(request("username"),"?")>0 or Instr(request("username"),"&")>0 or Instr(request("username"),";")>0 or Instr(request("username"),",")>0 or Instr(request("username"),"'")>0 or Instr(request("username"),",")>0 or Instr(request("username"),chr(34))>0 or Instr(request("username"),"+") >0 then
	errmsg=errmsg+"<br>"+"<li>您的用户名中含有非法字符!"
	founderr=true
	else
	username=trim(request("username"))
end if

if request("password")="" or len(request("password"))>20 then
	errmsg=errmsg+"<br>"+"<li>请输入您的密码(长度不能大于20)!"
	founderr=true
	else
	password=request("password")
end if

if request("password2")="" or len(request("password"))>20 then
	errmsg=errmsg+"<br>"+"<li>请输入您的新密码(长度不能大于20)!"
	founderr=true
	else
	password2=request("password2")
end if

if request("password3")="" or len(request("password"))>20 then
	errmsg=errmsg+"<br>"+"<li>请输入您的确认新密码(长度不能大于20)!"
	founderr=true
	else
	password3=request("password3")
end if

if password2<>password3 then
	errmsg=errmsg+"<br>"+"<li>您输入的密码和确认密码不一致!"
	founderr=true
	else
	password2=password2
end if

'----------------------------------检验用户是否合法
'response.write (username)
'response.write (password)
set rs=server.createobject("adodb.recordset")
sql = "Select password From admin Where username='"&Username&"' And password='"&password&"'"	
'response.write (sql)
rs.open sql, conn,1,3
If rs.EOF Then
	errmsg=errmsg+"<br>"+"<li>用户名和密码不正确 !"
	founderr=true
	
end if



if founderr=true then 
	call error
else 
	call saveinfo()
	successmess="密码更改成功"
	backurl="ad_view.asp"
	call success
end if

sub saveinfo ()
rs("password")=password2
rs.update
rs.close
set rs=nothing
Conn.Close
Set Conn=Nothing
end sub

%>