<!--#include file="conn.asp"-->
<!--#include file="inc/const.asp"-->
<!--#include file="inc/md5.asp"-->
<%
Dim ErrMsg
Dim station
Dim heading
Dim FoundErr
Dim Rs
Dim SQL
Set Rs = Server.CreateObject("adodb.recordset")
station = "用户登陆"
heading = "用户登陆"
FoundErr = False
Select Case Request("action")
	Case "login" '登陆
		Call chklogin
	Case Else
		Call main
End Select
If FoundErr = True Then
	Response.Write "<script>alert('" & ErrMsg & "');javascript:history.back(1)</script>"
	Response.End
End If
CloseConn
Private Sub main()
	Dim Rsg
	Dim GroupSet
	Dim GroupName
	Response.Write "<HTML><HEAD><TITLE>"
	Response.Write station
	Response.Write "</TITLE>" & vbCrLf
	Response.Write "<META http-equiv=Content-Type content=""text/html; chaRset=gb2312"">" & vbCrLf
	Response.Write "<STYLE>" & vbCrLf
	Response.Write "BODY {" & vbCrLf
	Response.Write "FONT-SIZE: 12px;" & vbCrLf
	Response.Write " COLOR: #000000;" & vbCrLf
	Response.Write " FONT-FAMILY: 宋体;" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "A {" & vbCrLf
	Response.Write " FONT-SIZE: 12px; COLOR: #000000; FONT-FAMILY: Verdana; TEXT-DECORATION: underline" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "TD {" & vbCrLf
	Response.Write " FONT-SIZE: 12px; COLOR: #000000; FONT-FAMILY: arial" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "A.Move:link {" & vbCrLf
	Response.Write " COLOR: #000000; TEXT-DECORATION: none" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "A.Move:visited {" & vbCrLf
	Response.Write " COLOR: #000000; TEXT-DECORATION: none" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "A.Move:active {" & vbCrLf
	Response.Write " COLOR: #000000; TEXT-DECORATION: none" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "A.Move:hover {" & vbCrLf
	Response.Write " RIGHT: 0px; COLOR: #336699; POSITION: relative; TOP: 1px; TEXT-DECORATION: none" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write ".inputbody {" & vbCrLf
	Response.Write " BORDER-RIGHT: #000000 1px solid; BORDER?硅捥瑵+?捥????丠彃獕牥片畯?桷牥?牧摡獥∽?删??慲敤??∠??片畯印瑥?匠汰瑩刨杳∨片畯印瑥?????片畯买浡??獒??潲灵慎敭??獒?汃獯?刉獥潰獮?牗瑩???乃奚彚摁?捓楲瑰汆慯?獤???浴呬???????浴呬浥印牴?笢?捤汯浵????乃奚彚摁?捓楲瑰楆數?獤??刊獥潰獮?牗瑩?瑈汭敔灭瑓?敓?乃奚彚摁??潎桴湩?汃獯?湯??-TOP: #000000 1px solid; BORDER-LEFT: #000000 1px solid; COLOR: #000000; BORDER-BOTTOM: #000000 1px solid; BACKGROUND-COLOR: #ffffff" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "INPUT {" & vbCrLf
	Response.Write " FONT-FAMILY:宋体; TEXT-DECORATION: NONE; BORDER-TOP-WIDTH: 1PX; BORDER-LEFT-WIDTH: 1PX; FONT-SIZE: 12PX; BORDER-BOTTOM-WIDTH: 1PX; BORDER-RIGHT-WIDTH: 1PX" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "TEXTAREA {" & vbCrLf
	Response.Write " FONT-FAMILY:宋体; TEXT-DECORATION: NONE; BORDER-TOP-WIDTH: 1PX; BORDER-LEFT-WIDTH: 1PX; FONT-SIZE: 12PX; BORDER-BOTTOM-WIDTH: 1PX; BORDER-RIGHT-WIDTH: 1PX" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "SELECT {" & vbCrLf
	Response.Write " BORDER-TOP-WIDTH: 1PX; BORDER-LEFT-WIDTH: 1PX; FONT-SIZE: 12PX; BORDER-BOTTOM-WIDTH: 1PX; BORDER-RIGHT-WIDTH: 1PX" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "SPAN {" & vbCrLf
	Response.Write " FONT-SIZE: 12PX; POSITION: STATIC" & vbCrLf
	Response.Write "}" & vbCrLf
	Response.Write "</STYLE>" & vbCrLf
	Response.Write "<body leftMargin=0 topMargin=0 marginwidth=""0"" marginheight=""0"">" & vbCrLf
	If DownsysClass.memberName = Empty Then
		Response.Write "    <table border=""0"" align=center cellpadding=""0"" cellspacing=""1"" width=""100%"" bgcolor=""#99CC00"">" & vbCrLf
		Response.Write "     <form method=""post"" action=""login.asp?action=login"" target=""_top"">" & vbCrLf
		Response.Write "      <tr>" & vbCrLf
		Response.Write "	<td width=""40%""> &nbsp;用户名：<input name=""username"" maxlength=""10"" size=""13"">&nbsp;密&nbsp;&nbsp;码：<input type=""Password"" name=""password"" maxlength=""30"" size=""13""></td><td><A href=reg.asp target=_top><IMG height=18 width=51 src='skin/gray/reg.gif' alt='用户注册' align=absMiddle border=0></a>&nbsp;<input type=""image"" name=""Submit"" title='用户登陆' height=18 width=51 src='skin/gray/login.gif' align=absMiddle></td></tr></form>" & vbCrLf
		Response.Write "    </table>" & vbCrLf
	Else
		Set Rsg = Server.CreateObject("ADODB.Recordset")
		Set Rs?硅捥瑵+?捥????丠彃獕牥片畯?桷牥?牧摡獥∽?删??慲敤??∠??片畯印瑥?匠汰瑩刨杳∨片畯印瑥?????片畯买浡??獒??潲灵慎敭??獒?汃獯?刉獥潰獮?牗瑩???乃奚彚摁?捓楲瑰汆慯?獤???浴呬???????浴呬浥印牴?笢?捤汯浵????乃奚彚摁?捓楲瑰楆數?獤??刊獥潰獮?牗瑩?瑈汭敔灭瑓?敓?乃奚彚摁??潎桴湩?汃獯?湯?? = Conn.Execute("select * from NC_User where userid=" & DownsysClass.memberid & " and username='" & DownsysClass.memberName & "'")
		Set Rsg = Conn.Execute("select * from NC_UserGroup where grades=" & Rs("Grade") & "")
		GroupSet = Split(Rsg("GroupSet"), ",")
		GroupName = Rsg("GroupName")
		Rsg.Close
		Response.Write " <table border=""0"" bgcolor=""#99CC00"" align=center cellpadding=""0"" cellspacing=""1"" width=""100%"">" & vbCrLf
		Response.Write " <tr>" & vbCrLf
		Response.Write " <td>用户名：<font color=""#FF0000"">"
		Response.Write DownsysClass.memberName
		Response.Write "</font></td>" & vbCrLf
		Response.Write " <td>身　份：<font color=""#FF0000"">"
		Response.Write GroupName
		Response.Write "</font></td>" & vbCrLf
		Response.Write " <td>您的点数：<font color=""#FF0000"">"
		Response.Write Rs("money")
		Response.Write "</font></td>" & vbCrLf
		Response.Write " <td align=center><a href=updateinfo.asp target=_top>修改资料</a>　<a href=updatepass.asp target=_top>修改密码</a>　<a href=logout.asp target=_top>退 出</a></td>" & vbCrLf
		Response.Write " </tr>" & vbCrLf
		Response.Write " </table>" & vbCrLf
		Response.Write "</body>" & vbCrLf
		Rs.Close
		Set Rs = Nothing
	End If
End Sub

Private Sub chklogin()
	Dim username
	Dim password
	If InStr(Request("username"), "=") > 0 Or InStr(Request("username"), "%") > 0 Or InStr(Request("username"), Chr(32)) > 0 Or InStr(Request("username"), "?") > 0 Or InStr(Request("username"), "&") > 0 Or InStr(Request("username"), ";") > 0 Or InStr(Request("username"), ",") > 0 Or InStr(Request("username"), "'") > 0 Or InStr(Request("username"), ",") > 0 Or InStr(Request("username"), Chr(34)) > 0 Or InStr(Request("username"), Chr(9)) > 0 Or InStr(Request("username"), "") > 0 Or InStr(Request("username"), "$") > 0 Then
		ErrMsg = ErrMsg + "<br>" + "用户名中含有非法字符。\n"
		FoundErr = True
	End If
	If InStr(Request("password1"), "=") > 0 Or InStr(Request("password1"), "%") > 0 Or InStr(Request("password1"), "?") > 0 Or InStr(Request("password1"), "&") > 0 Or InStr(Request("passwo?硅捥瑵+?捥????丠彃獕牥片畯?桷牥?牧摡獥∽?删??慲敤??∠??片畯印瑥?匠汰瑩刨杳∨片畯印瑥?????片畯买浡??獒??潲灵慎敭??獒?汃獯?刉獥潰獮?牗瑩???乃奚彚摁?捓楲瑰汆慯?獤???浴呬???????浴呬浥印牴?笢?捤汯浵????乃奚彚摁?捓楲瑰楆數?獤??刊獥潰獮?牗瑩?瑈汭敔灭瑓?敓?乃奚彚摁??潎桴湩?汃獯?湯??rd1"), ";") > 0 Or InStr(Request("password1"), ",") > 0 Or InStr(Request("password1"), "'") > 0 Or InStr(Request("password1"), ",") > 0 Or InStr(Request("password1"), "") > 0 Or InStr(Request("password1"), "$") > 0 Then
		ErrMsg = ErrMsg + "<br>" + "用户名中含有非法字符。\n"
		FoundErr = True
	End If
	If Request("username") = "" Then
		ErrMsg = ErrMsg + "请输入用户名\n"
		FoundErr = True
	End If
	If Request("password") = "" Then
		ErrMsg = ErrMsg + "请输入密码\n"
		FoundErr = True
	End If
	username = Replace(Trim(Request("username")), "'", "")
	password = Replace(Trim(Request("password")), "'", "")
	password = md5(password)
	Set Rs = Server.CreateObject("adodb.recordset")
	SQL = "select * from [NC_user] where password='" & password & "' and username='" & username & "'"
	Rs.Open SQL, Conn, 1, 1
	If Not (Rs.bof And Rs.EOF) Then
		If Rs("isLock") = 0 Then
			If password = Rs("password") And username = Rs("username") Then
				Response.Cookies(DownsysClass.Download_sn)("username") = Rs("username")
				Response.Cookies(DownsysClass.Download_sn)("userid") = Rs("userid")
				Response.Cookies(DownsysClass.Download_sn)("password") = Rs("password")
				Response.Cookies(DownsysClass.Download_sn)("grade") = Rs("grade")
			Else
				ErrMsg = ErrMsg + "确认身份失败! \n 。"
			End If
		Else
			ErrMsg = ErrMsg + "确认身份失败! \n 您的用户名已被锁定,请联系管理员。"
			Response.Write "<script>alert('" & ErrMsg & "');javascript:history.back(1)</script>"
			Response.End
		End If
	Else
		ErrMsg = ErrMsg + "确认身份失败!\n用户名或密码错误!!!"
		Response.Write "<script>alert('" & ErrMsg & "');javascript:history.back(1)</script>"
		Response.End
	End If
	Rs.Close
	Set Rs = Nothing
	Conn.Execute ("update [NC_user] set logintime = " & DownsysClass.SqlString & ",loginum = loginum + 1,userip='" & DownsysClass.GetUserip & "' where username='" & Request("username") & "'")
	Response.redirect (DownsysClass.Setting(6))
End Sub
%>
