<% data_path="../"  %>
<!--#include file="../conn/conn.asp"--> 
 <%	 		'过滤SQL非法字符并格式化html代码
		Function Replace_Text(fString)
			If IsNull(fString) Then
			Replace_Text=""
			Exit Function
			Else
			fString=Trim(fString)
			fString=Replace(fString,">","")
			fString=Replace(fString,"<","")
			fString=Replace(fString,"'","")
			fString=Replace(fString,";","；")
			fString=Replace(fString,"--","—")
			fString=Server.HtmlEncode(fString)
			Replace_Text=fString
			End If	
		End function
 '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 '获取传递的关键字
     str=Replace_Text(Trim(Request("strs")))
   
  		Dim XML_Result
      if issession=0 then
	  gradeid=request.Cookies("gradeid")
	  yxflag=request.Cookies("yxflag")
	  userid=request.Cookies("Yxmemberid")
	  else
	  gradeid=session("gradeid")
	  yxflag=session("yxflag")
	  userid=session("id")
	  end if
		   XML_Result="<?xml version=""1.0"" encoding=""gb2312"" ?><Websen><resultmsg><logid>"
		  if userid<>"" then    
		  if yxflag=1 then                            '通过审核的用户 
		  set rsrole=server.CreateObject("adodb.recordset")
		  sqlrole="select   rolelist from Websen_vipgrade where roleid="&gradeid
		  rsrole.open sqlrole,conn,1,1
		  if not rsrole.eof then 
 		  if instr(rsrole("rolelist"),"msg")>0 then              '权限允许的用户
 		                              
		   XML_Result=XML_Result&"1"
		  else
		   XML_Result=XML_Result&"0"
		  end if
		  rsrole.close
		  end if
 		  end if
		  else
		   XML_Result=XML_Result&"0"
		  end if
		   XML_Result=XML_Result&"</logid><logid>"&str&"</logid></resultmsg></Websen>"
		  '------------------------------------- 
		
		
	' 设置MIME Type为XML文档
	 Response.ContentType="application/xml"
	 Response.Charset="utf-8"
	' 输出搜索结果
     Response.Write(XML_Result)
  
%>