<!--#include file="conn.asp"-->
<%
dim com_name,com_pass
dim rs,sql
com_name=Request.Form("com_name")
com_name=replace(com_name," ","")
com_name=replace(com_name,"'","")
com_name=replace(com_name,"&","")
com_pass=Request.Form("com_pass")
sql="select * from com_user where com_name='"&com_name&"' and com_pass='"&com_pass&"' and pas=yes"
set rs= Server.CreateObject("ADODB.Recordset") 
rs.open sql,conn,1,1
if rs.eof then
response.write"<SCRIPT language=JavaScript>alert('密码错误或帐号尚未通过审核!');"
response.write"javascript:history.go(-1)</SCRIPT>"
response.end
rs.close
set rs=nothing
else 
session("com_id")=rs("com_id")
rs.close 
set rs=nothing 
response.write"<SCRIPT language=JavaScript>alert('登陆成功!');"
response.write"this.location.href='index.asp';</SCRIPT>" 
conn.close
set conn=nothing 
end if%>