<!--#include file="conn.asp"-->
<%
if session("admin")="" then
conn.close
set conn = nothing
response.Write "<script language='javascript'>alert('请先登录！');location.href='index.asp' ;</script>"
response.End
else
if request.cookies("sundxshop")("admin")="" then
conn.close
set conn = nothing
response.Write "<script language='javascript'>alert('请先登录！');location.href='index.asp' ;</script>"
response.End
end if
end if

dim action,goods,username
action=FormatSQL(SafeRequest("action",0))
goods=SafeRequest("dan",1)
username=SafeRequest("username",0)
select case action
case "save"
if session("rank")>1 then
conn.close
set conn = nothing
response.Write "<script language='javascript'>alert('你无权更改订单状态！');history.go(-1);</script>"
response.End
end if
dim rsscore,strscore
if request.form("state")<>"" then
set rs=server.CreateObject("adodb.recordset")
rs.Open "select state,score,id,productnum from orders where orders.username='"&username&"' and goods='"&goods&"'",conn,1,3
do while not rs.EOF
if trim(request.form("state"))=3 then
strscore=rs("score")
set rsscore=server.CreateObject("adodb.recordset")
rsscore.open "select score from DV_User where username='"&username&"' ",conn,1,3
rsscore("score") = rs("score") + rsscore("score")
rsscore.update
rsscore.close
set rsscore = nothing
set rs=server.CreateObject("adodb.recordset")
rs.open "select id,goods,productnum,state from orders  where goods='"&goods&"' " ,conn,1,3
do while not rs.EOF

rs("state")=3
rs.Update
set rspro=server.CreateObject("adodb.recordset")
rspro.open "select id,solded,stock from product  where id="&rs("id")&" " ,conn,1,3

rspro("solded")=rspro("solded")+rs("productnum")
rspro("stock")=rspro("stock")-rs("productnum")
rspro.Update


rs.MoveNext
loop

else 
rs("state")=request.form("state")

end if
rs.Update
rs.MoveNext
loop
rs.Close
set rs=nothing
conn.close
set conn = nothing
end if

response.Write "<script language=javascript>alert('订单状态修改成功！');location.href='vieworder.asp?dan="&goods&"&username="&username&"';</script>"
case "del"
if session("rank")>1 then
conn.close
set conn = nothing
response.Write "<script language='javascript'>alert('你无权删除订单！');history.go(-1);</script>"
response.End
end if

conn.execute "delete from orders where goods='"&goods&"' "
response.Write "<script language=javascript>alert('订单删除成功！');window.close();</script>"
rs.close
set rs=nothing
conn.close
set conn=nothing

case "orders"
if session("rank")>2 then
conn.close
set conn = nothing
response.Write "<script language='javascript'>alert('你无权评论订单！');history.go(-1);</script>"
response.End
end if
set rs=server.CreateObject("adodb.recordset")
rs.open "select orders.remarks from orders where goods='"&goods&"'",conn,1,3
rs("remarks")=trim(request.form("remarks"))
rs.update
response.Write "<script language=javascript>alert('评论添加成功！');window.close();</script>"
rs.close
set rs=nothing
conn.close
set conn=nothing
end select

%>

