<!--#include file="inc_const.asp"-->
<%response.expires=0
Response.CacheControl = "Private"
application.lock

if application(ConstStr & "_allowwritegb")="0" then
  response.redirect("showerr.asp?errtext=管理员禁止写留言！点此进入<a href=guest.asp>留言本</a>！")
  application.unlock
  response.end
end if

set cschat=server.createobject("ffcschat.cssbchat")

cschat.FilterStr=application(ConstStr & "_saysfilterstr")
my_level=cschat.getLevel(Session,Application(ConstStr & "_user_list"),Application(ConstStr & "_room_list"))
myname=cschat.myname

application.unlock

if my_level=0 then
  login=false
  myname=cschat.trdb(request("name"))
  passwd = cschat.trPass(request.Form("passwd"))
else 
  login=true  
end if
exp_num=clng(cschat.trdb(request.form("exp_num")))
mess = cschat.trdb(left(request("mess"),clng(application(ConstStr & "_guestbooklength"))))
email=cschat.trdb(request.Form("email"))
if email="" then email=" "
addr=cschat.trdb(request.Form("addr"))
if addr="" then addr=" "
web=cschat.trdb(request.Form("web"))
if web="" then web=" "
title=cschat.trdb(request.Form("title"))
towho=cschat.trdb(request.form("towho"))

set cschat=nothing

if towho="" then towho="大家"
secret=request("secret")

response.cookies("guest_email")=email
response.cookies("guest_web")=web
response.cookies("guest_addr")=addr
For Each cookie in Response.Cookies
  Response.Cookies(cookie).Expires = now()+30
Next
Set Conn=Server.CreateObject("ADODB.Connection") 
conn.open Application(ConstStr & "_connstr")
errText = ""
if myname = "" OR title="" or mess="" then
  errText="输入错误：用户名、发言标题、发言内容不能为空！"
elseif not login then
  set rs = Conn.execute("SELECT passwd,user_level FROM user WHERE username='" & myname &"'")
  if (rs.bof or rs.eof) then
    errText="输入错误：用户"&myname&"尚未注册！"
  elseif passwd<>rs("passwd") then
    errText="输入错误：你输入了错误的密码！"
  end if
end if

'if request.ServerVariables("HTTP_VIA")<>"" then
'  ip=request.ServerVariables("HTTP_X_FORWARDED_FOR")
'else
  ip=request.ServerVariables("REMOTE_ADDR")
'end if

set rs=Conn.execute("SELECT count(*) as cc FROM guestbook WHERE (who='"&myname&"' or ip='"&ip&"') and datediff('n',post_time,'"&now()&"')<10")
if rs("cc")-Application(ConstStr & "_newguestbooknum")>=0 then errText="禁止同一个帐号或ip在较短的时间内连续留言！"

if secret<>"0" then secret=1
if towho="大家" then secret=0
if secret=1 then
  set rs = Conn.execute("SELECT passwd FROM user WHERE username='" & towho &"'")
  if (rs.bof or rs.eof) then
    errText="你使用了私人留言，但你的留言对象"&towho&"不存在！"
  end if
end if
if errText="" then
  insert_item="who,towho,secret,ip,email,web,addr,post_time,text_title,text_body"
  sz="'"&myname&"','"&towho&"',"&secret&",'"&ip&"','"&email&"','"&web&"','"&addr&"',now(),'"&title&"','"&mess&"'"
  into_db = "INSERT INTO guestbook ("&insert_item&") VALUES ("&sz&")"
  conn.Execute(into_db)
end if

rs.close
set rs=nothing
conn.close
set conn=nothing
if errText="" then
  response.redirect("guest.asp")
else
  response.redirect("showerr.asp?errtext="&ErrText)
end if%>