<!-- #include file="conn.asp" -->
<%
  dim admin
  dim psw
  if (not isnull(request("username"))) then
    admin=request.form("username")
admin=replace(admin,"'","")
admin=replace(admin,";","")
    psw=request.form("password")
psw=replace(psw,"'","")
psw=replace(psw,";","")
  end if
  set rs=server.createobject("adodb.recordset")
  sql="select * from admin where admin='"&admin&"' and psw='"&psw&"'"
  rs.open sql,conn,3,3
  if not rs.eof and not rs.bof then
  session("admin")=true
  response.redirect "main.asp"
  else
  response.redirect "error1.asp?err_on=10"
  end if
  rs.close
  set rs=nothing
  conn.close
  set conn=nothing
%>