<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<%
If Instr(request("UserName"),"=")>0 or Instr(request("UserName"),"%")>0 or Instr(request("UserName"),chr(32))>0 or Instr(request("UserName"),"?")>0 or Instr(request("UserName"),"&")>0 or Instr(request("UserName"),";")>0 or Instr(request("UserName"),",")>0 or Instr(request("UserName"),"'")>0 or Instr(request("UserName"),"?")>0 or Instr(request("UserName"),chr(34))>0 or Instr(request("UserName"),chr(9))>0 or Instr(request("UserName"),"")>0 or Instr(request("UserName"),"$")>0 or Instr(request("UserName"),">")>0 or Instr(request("UserName"),"<")>0 or Instr(request("UserName"),"@")>0 or Instr(request("UserName"),"""")>0 then 

response.write "<script LANGUAGE='javascript'>alert('对不起！您提交的会员名中含有非法字符！');history.go(-1);</script>"

response.end 

end if 

dim UserName,UserPassword

UserName       = checkFFSQLStr(trim(request("UserName")))

UserPassword   = md5(trim(request("UserPassword")))

SQL = "select * from [User] where UserName='"& UserName &"'"
set rs=server.CreateObject("adodb.recordset")
rs.Open SQL,conn_m,1,3

if rs.bof and rs.eof then
response.write "<script LANGUAGE='javascript'>alert('对不起，系统中找不到该会员名，请检查您的输入是否有误！');history.go(-1);</script>"
response.end
end if

if UserPassword<>trim(rs("UserPassword")) then
response.write "<script LANGUAGE='javascript'>alert('对不起，您输入的密码不正确，请重新填写！');history.go(-1);</script>"
response.end
end if

if rs("Flag")="" or rs("UserNumberID")="" then
response.write "<script LANGUAGE='javascript'>alert('对不起，您的帐号数据参数出错，请与本站客服中心联系！');history.go(-1);</script>"
response.end
end if

if (int(session("SafeCode"))<>int(request("yz"))) then

response.write "<script LANGUAGE='javascript'>alert('对不起！验证码错误！');history.go(-1);</script>"
response.end

end if

Session("XiaBoleUserName")         = trim(rs("UserName"))
Session("XiaBoleCredit")           = INT(rs("Credit"))
Session("XiaBoleFlag")             = trim(rs("Flag"))
Session("XiaBoleUserNumberID")     = trim(rs("UserNumberID"))
Session("XiaBolePurview")          = trim(rs("Purview"))
Session("XiaBoleName")             = trim(rs("Name"))


rs("lastlogin")                    = now()
rs("logins")                       = rs("logins")+1

rs("LastIP")                       = Request.ServerVariables("REMOTE_ADDR")

rs.Update
rs.Close
set rs=nothing

Conn_m.Close
Set Conn_m = Nothing
%>