<!--#include file="../Include/Conno.asp"-->
<!--#include file="../Include/Char.asp"-->
<!--#include file="../Include/md5.asp"-->
<%
	dim mSql,rs
	dim mUserName,mPassword
	dim mIntegral
	mIntegral = 10 '登陆一次积分加10
	mUserName = Trim(Request("txtUserName"))
	mPassword = Trim(Request("txtPassword"))
if Instr(LCase(mUserName),"'") > 0 or Instr(LCase(mUserName),"select ") > 0 or Instr(LCase(mUserName),"insert ") > 0 or Instr(LCase(mUserName),"delete from") > 0 or Instr(LCase(mUserName),"count(") > 0 or Instr(LCase(mUserName),"drop table") > 0 or Instr(LCase(mUserName),"update ") > 0 or Instr(LCase(mUserName),"truncate ") > 0 or Instr(LCase(mUserName),"asc(") > 0 or Instr(LCase(mUserName),"mid(") > 0 or Instr(LCase(mUserName),"char(") > 0 or Instr(LCase(mUserName),"xp_cmdshell") > 0 or Instr(LCase(mUserName),"exec master") > 0 or Instr(LCase(mUserName),"net localgroup administrators") > 0  or Instr(LCase(mUserName)," and ") > 0 or Instr(LCase(mUserName),"net user") > 0 or Instr(LCase(mUserName)," or ") > 0 or Instr(LCase(mUserName)," ' ") > 0 then
%>
   <script language="javascript">
   alert("您输入的用户名中有非法字符串");
   window.location='/logins/member/login.asp'
   </script>
<%response.End()
end if


if Instr(LCase(mPassword),"'") > 0 or Instr(LCase(mPassword),"select ") > 0 or Instr(LCase(mPassword),"insert ") > 0 or Instr(LCase(mPassword),"delete from") > 0 or Instr(LCase(mPassword),"count(") > 0 or Instr(LCase(mPassword),"drop table") > 0 or Instr(LCase(mPassword),"update ") > 0 or Instr(LCase(mPassword),"truncate ") > 0 or Instr(LCase(mPassword),"asc(") > 0 or Instr(LCase(mPassword),"mid(") > 0 or Instr(LCase(mPassword),"char(") > 0 or Instr(LCase(mPassword),"xp_cmdshell") > 0 or Instr(LCase(mPassword),"exec master") > 0 or Instr(LCase(mPassword),"net localgroup administrators") > 0  or Instr(LCase(mPassword)," and ") > 0 or Instr(LCase(mPassword),"net user") > 0 or Instr(LCase(mPassword)," or ") > 0 or Instr(LCase(mPassword)," ' ") > 0 then
%>
   <script language="javascript">
   alert("您输入的密码中有非法字符串");
   window.location='/logins/member/login.asp'
   </script>
<%response.End()
end if



	'查找用户
	mSql = "Select F_ID,F_UserName,F_Password,F_RealName,F_Email,F_Tel,f_grade,F_Mobile,F_WebSite,F_Address from T_Member Where F_IsCheck=1 and F_UserName='" & mUserName & "'"
    Set rs = conn.Execute(mSql)
	if rs.bof and rs.eof then
	   '无此用户
	   rs.Close
	   CloseDatabase()
	   call Msgbox("对不起，不存在该用户名，或该用户名已被锁定.需管理员审核！",1)
Response.Redirect "syslog.asp"
       Response.end			
	else
   	   if md5(mPassword,16)<>rs("F_PassWord") then
          '密码错误
		  'rs.Close
	      
		  Call Msgbox("对不起，您的密码不正确！请输入正确的密码！",1)
		 Response.Redirect "syslog.asp"
	   else

          'if Cookies
		  UserCookies = Request.Form("selUserCookies")
          if isnull(UserCookies) or UserCookies="" then UserCookies="0"
          select case usercookies
          case "0"
         	Response.Cookies("aspxnet")("UserCookies") = UserCookies
          case 1
          	Response.Cookies("aspxnet").Expires=Date+1
	        Response.Cookies("aspxnet")("UserCookies") = UserCookies
          case 2
  	        Response.Cookies("aspxnet").Expires=Date+31
	        Response.Cookies("aspxnet")("UserCookies") = UserCookies
          case 3
	        Response.Cookies("aspxnet").Expires=Date+365
	        Response.Cookies("aspxnet")("UserCookies") = UserCookies
          end select
		  
          'Write Cookies 
          Response.Cookies("aspxnet")("RandNumber") = "i9sHflS2fAj883"
		  
          Response.Cookies("aspxnet")("CurUserID") = rs("F_ID")
          Session("CurUserID") = rs("F_ID")
          Response.Cookies("aspxnet")("CurUserName") = rs("F_UserName")
          Response.Cookies("aspxnet")("Curgrade") =rs("f_grade")
		   Session("CurUserID") = rs("F_ID")
 Session("CurUserName") = rs("F_UserName")
 Session("curgrade") = rs("f_grade")
		 ' Response.Cookies("aspxnet")("RealName") = checkStr(rs("F_RealName"))

		   
		  'Response.Cookies("aspxnet")("Email") = checkStr(rs("F_Email"))

		  'Response.Cookies("aspxnet")("Tel") = checkStr(rs("F_Tel"))
		  'Response.Cookies("aspxnet")("Mobile") = checkStr(rs("F_Mobile"))
		  'Response.Cookies("aspxnet")("Address") = checkStr(rs("F_Address"))
		
          Session.Contents("OnlinUserName") = checkStr(rs("F_UserName"))
 

          '更新用户登陆信息
		  mIPInfo=request.ServerVariables("REMOTE_ADDR")
		  mSql = "Update T_Member set "
		  mSql = mSql + "F_LoginCount=F_LoginCount+1,"
		  mSql = mSql + "F_Integral=F_Integral+"&mIntegral&","
		  mSql = mSql + "F_LastLoginTime='"&now&"',"
		  mSql = mSql + "F_IPInfo='"&mIPInfo&"'"
		  mSql = mSql +" Where F_UserName='" & rs("F_UserName") &"'"
		  conn.execute(mSql)
		  rs.Close

	      '返回	   
		  m_Return = Request.QueryString("return")
          IF m_Return = "" then
		    Response.Redirect "syslog.asp"
		  Else
		    Response.Redirect m_Return
		  End if
		    Response.end
	   End if
	End if
    rs.close
%>