<!--#include file="conn.asp"-->
<%
session("rz")=""
session("roomid")=""
User=chkstr(trim(request.form("User")),14)
Pass=chkstr(trim(request.form("Pass")),20)
set rs = Server.CreateObject("ADODB.Recordset")
rs.Open "Select * From admin where username='"&user&"'",conn,1,3
if rs.eof then 
	rs.close
	%>
    <script language=vbscript>  
  		MsgBox "错误：该用户不存在或密码错误！"  
  		location.href = "javascript:history.back()"  
	</script>  
<%else
	if pass<>rs("pass") then%>
    <script language=vbscript>  
  		MsgBox "错误：该用户不存在或密码错误！"  
  		location.href = "javascript:history.back()"  
	</script>  
	<%else
	if request.Form("B1") = "登录" then
		session("rz")="adminsuper"
		session("roomid")="UserInfo"
		rs.close
		response.redirect("top.asp")
	else
		session("admin")=User
		session("rz")="adminsuper"
		session("roomid")="UserInfo"
		rs.close
		response.redirect("updatepwd.asp")
	end if
end if
end if%>
