<!--#include file="../include/conno.asp"-->
<!--#include file="../include/md5pass.asp"-->
<%  
	if Trim(Request.form("txtCheckCode"))<>CStr(session("CheckCode")) then
       response.write "<script>alert('您输入的确认码和系统产生的不一致，请重新输入！');this.location.href='login.asp';</Script>"
	   Response.end
    end if
	   user=replace(trim(request.form("txtUserName")),"'","''")
       password=replace(trim(request.form("txtPassword")),"'","''")
	   w_ip=Request.ServerVariables("REMOTE_ADDR")
	   if instr(user,"%") or instr(user,"#") or instr(user,"?") or instr(user,"|") then
	   response.write "<script language=javascript>alert('您的姓名含有非法字符！');this.location.href='login.asp';</script>"
	   response.end 
	   end if
	   if instr(password,"%") or instr(password,"#") or instr(password,"?") or instr(password,"|") then
	   response.write "<script language=javascript>alert('您的密码含有非法字符！');this.location.href='login.asp';</script>"
	   response.end 
	   end if
	   sql="select * from tb_admin where w_name='"&user&"' and w_pass='"&md5pass(password)&"'"
	   set rs=conn.execute(sql)
	   if rs.eof then
	   	   Response.Write("<script language=javascript>alert('您所输入的管理员姓名和密码有误！');this.location.href='login.asp';</script>")
		   Response.End
       else 
	sql1="select * from [tb_admin] where w_name='"&user&"' and w_pass='"&md5pass(password)&"'"
    set rs1=Server.CreateObject("Adodb.Recordset")
	rs1.open sql1,conn,1,3
		   rs1("w_utime")=rs1("w_lasttime")
		   rs1("w_lasttime") =now()
		   rs1("w_lastip") =w_ip
		   rs1("w_number") =rs1("w_number")+1
		   rs1.Update
 	   Session("w_admin")=user
	   Session("w_fullname")=rs("w_fullname")
	   Session("w_type")=rs("w_type")
       Session("w_number")=rs("w_number")
	   Session("w_lastip")=w_ip
	   Session("adminRights")=rs("rights")
	   Response.Write("<script language=javascript>alert('欢迎您："&Session("w_fullname")&" \n\n这是您第"&session("w_number")&"登陆本系统\n\n本次登陆IP为："&session("w_lastip")&"\n\n登陆时间为："&now()&"');this.location.href='admin_main.asp';</script>")
	   end if
	   rs1.close
	   set rs1=nothing
	   conn.close
	   set conn=nothing
%>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
