<%
'程序名称：千纸鹤网站管理系统
'程序作者：千纸鹤
'作者邮箱：qzhxxw@sina.com
'作者 Q Q：138999501
'作者电话：0000000000
'官方主页：http://www.qqzzhh.com/
'官方论坛：http://www.qqzzhh.com/bbs
%>
<!--#include file="inc/conn.asp"-->
<!--#include file="inc/set.asp"-->
<!--#include file="inc/dll.asp"-->
<!--#include file="inc/inc.asp"-->
<!--#include file="inc/md5.asp"-->
<%call yecaosql()
action=trim(request("action"))
user=trim(request.form("user"))
answer=trim(request("answer"))
pass=trim(request("pass"))
passpass=trim(request("passpass"))
call top()%>
<table border="0"  cellspacing="0" cellpadding="0" align=center class=bgcolor>
<tr><td class=left></td>
<td class=width>
<table width=100% border=0  cellspacing="0" cellpadding="0">
<tr><td valign=top><%call br()%>
<table border="0"   cellspacing="0" cellpadding="0">
<td  class=lefttopcenter>&emsp;※&nbsp;会员登陆</td><td  class=lefttopright></td></tr></table>
<table border="0" cellspacing="0" cellpadding="0"><tr>
<td valign=top class=leftcentercenter  height=150 >
<%call login()%>
</td><td class=leftcenterright></td></tr></table>
<table border="0"  cellspacing="0" cellpadding="0"><tr><td class=leftfootcenter></td><td class=leftfootright></td></tr></table>
<%call br%>
</td>
<td  width="5"></td>
<td valign=top align=right><%call br%>
<%if action="" then%>
<table border="0" cellspacing="0" cellpadding="0">
<tr><td class=righttopleft></td>
<td class=righttopcenter>&emsp;※&nbsp;第一步：输入用户名</td>
</tr></table>
<table border="0"   cellspacing="0" cellpadding="0"><tr>
<td class=rightcenterleft></td>
<td  class=rightcentercenter valign=top>
<%call br()%><%call br()%><%call br()%>
<center>
<form name="form1" method="post" action="">
&emsp;请输入您的用户名：<input name="user" type="text" id="user" size="20" maxlength="20" class="yecao">
<%call br()%><%call br()%>
<input name="action" type="hidden" id="action" value="step2">
<input name="Next" type="submit" id="Next" style="cursor:hand;" value="下一步" class="put">&nbsp;<input name="Cancel" type="button" id="Cancel" style="cursor:hand;" onclick="window.location.href='index.asp'" value=" 取消 " class=put>
</form><%call br()%><%call br()%><%call br()%><%call br()%><%call br()%></center>
</TD></TR></table>
<table border="0" cellspacing="0" cellpadding="0" align=center><tr>
<td  class=rightfootleft></td><td class=rightfootcenter></td></tr></table>
</td></tr></table><%call br%></td><td class=right></td></tr></table>
<%elseif action="step2" then
if user="" or strLength(user)>14 or strLength(user)<4 then
Response.Write("<script>alert('请输入用户名不能大于10小于2！');javascript:history.back();</script>")
Response.End
else
if Instr(user,"=")>0 or Instr(user,"%")>0 or Instr(user,chr(32))>0 or Instr(user,"?")>0 or Instr(user,"&")>0 or Instr(user,";")>0 or Instr(user,",")>0 or Instr(user,"'")>0 or Instr(user,",")>0 or Instr(user,chr(34))>0 or Instr(user,chr(9))>0 or Instr(user,"")>0 or Instr(user,"$")>0 then
Response.Write("<script>alert('含有非法字符！');javascript:history.back();</script>")
Response.End
end if
end if
set rsget=server.createobject("adodb.recordset")
rsget.open "select user_name,user_question,user_answer,user_pass from [YC_user] where user_name='"&user&"'",conn,1,1
if rsget.bof and rsget.eof then
Response.Write("<script>alert('对不起！您的密码问题不正确！');javascript:history.back();</script>")
Response.End
end if%>
<table border="0" cellspacing="0" cellpadding="0">
<tr><td class=righttopleft></td>
<td class=righttopcenter>&emsp;※&nbsp;第二步：请您回答问题！谢谢！</td>
</tr></table>
<table border="0"   cellspacing="0" cellpadding="0"><tr>
<td class=rightcenterleft></td>
<td  class=rightcentercenter valign=top align=center>
<form name="form" method="post" action=""><br><br>
密码提示问题：<b><font color=red><%=rsget("user_question")%></font></b>&emsp;&emsp;&emsp;
您的答案：<input name="answer" type="text" size="20" maxlength="20" class="yecao"><%call br()%>
<input name="user" type="hidden" id="user" value="<%=rsget("user_name")%>">
<input name="action" type="hidden" id="action" value="step3">
<input name="PrevStep" type="button" id="PrevStep" value="上一步" style="cursor:hand;" onclick="history.go(-1)" class=put>&nbsp;<input name="NextStep" type="submit" id="NextStep" style="cursor:hand;" value="下一步" class=put>&nbsp;<input name="Cancel" type="button" id="Cancel" style="cursor:hand;" onclick="window.location.href='index.asp'" value=" 取消 " class=put></form><br><br>
</TD></TR></table>
<table border="0" cellspacing="0" cellpadding="0"><tr>
<td  class=rightfootleft></td><td class=rightfootcenter></td></tr></table>
</td></tr></table><%call br%></td><td class=right></td></tr></table>
<%rsget.close
set rsget=nothing
elseif action="step3" then
go_MD5=MD5(trim(replace(request("answer"),"'","")))
if answer="" then
Response.Write("<script>alert('请输入提示问题的答案！');javascript:history.back();</script>")
Response.End
end if	
set rsget=server.createobject("adodb.recordset")
rsget.open "select user_name,user_question,user_answer,user_pass from [YC_user] where user_name='"&user&"'",conn,1,1
if rsget.bof and rsget.eof then
Response.Write("<script>alert('对不起，用户名不存在！可能已经被管理员删除了。');javascript:history.back();</script>")
Response.End
elseif rsget("user_answer")<>go_MD5 then
Response.Write("<script>alert('对不起，你的答案不对！');javascript:history.back();</script>")
Response.End
end if		
%>
<table border="0" cellspacing="0" cellpadding="0">
<tr><td class=righttopleft></td>
<td class=righttopcenter>&emsp;※&nbsp;第三步：您的答案已经通过，请设置新密码！</td>
</tr></table>
<table border="0"   cellspacing="0" cellpadding="0"><tr>
<td class=rightcenterleft></td><form name="form1" method="post" action="">
<td  class=rightcentercenter valign=top align=center><br><br>
输入新密码：<input name="pass" type="password" id="pass" size="20" maxlength="20" class="yecao">&emsp;
确认新密码：<input name="passpass" type="password" id="passpass" size="20" maxlength="20" class="yecao"><br>
<input name="user" type="hidden" id="user" value="<%=rsget("user_name")%>"><br>
<input name="action" type="hidden" id="action" value="step4">
<input name="PrevStep" type="button" id="PrevStep" value="上一步" style="cursor:hand;" onclick="history.go(-1)" class=put>&nbsp;<input name="Next" type="submit" id="Next" style="cursor:hand;" value="下一步" class=put>&nbsp;<input name="Cancel" type="button" id="Cancel" style="cursor:hand;" onclick="window.location.href='index.asp'" value=" 取消 " class=put><br><br></form>
</TD></TR></table>
<table border="0" cellspacing="0" cellpadding="0" align=center><tr>
<td  class=rightfootleft></td><td class=rightfootcenter></td><td  class=rightfootright></td></tr></table>
</td></tr></table><%call br%></td><td class=right></td></tr></table>
<%rsget.close
set rsget=nothing
elseif action="step4" then

if request.form("pass")="" or strLength(request.form("pass"))>16 or strLength(request.form("pass"))<6 then
Response.Write("<script>alert('请输入密码(不能大于16小于6)');javascript:history.back();</script>")
Response.End
else
if Instr(request.form("pass"),"=")>0 or Instr(request.form("pass"),"%")>0 or Instr(request.form("pass"),chr(32))>0 or Instr(request.form("pass"),"?")>0 or Instr(request("pass"),"&")>0 or Instr(request("pass"),";")>0 or Instr(request("pass"),",")>0 or Instr(request("pass"),"'")>0 or Instr(request("pass"),",")>0 or Instr(request("pass"),chr(34))>0 or Instr(request("pass"),chr(9))>0 or Instr(request("pass"),"")>0 or Instr(request("pass"),"$")>0 then
Response.Write("<script>alert('密码中含有非法字符!');javascript:history.back();</script>")
Response.End
end if
end if
if request("passpass")="" or strLength(request("passpass"))>16 or strLength(request("passpass"))<6 then
Response.Write("<script>alert('请输入密码(不能大于16小于6)');javascript:history.back();</script>")
Response.End
end if
if request.form("passpass")<>request.form("pass")  then
Response.Write("<script>alert('密码和确认密码不一致！');javascript:history.back();</script>")
Response.End
end if
set rsget=server.createobject("adodb.recordset")
rsget.open "select user_name,user_question,user_answer,user_pass from [YC_user] where user_name='"&request.form("user")& "'",conn,1,3
if rsget.bof and rsget.eof then
Response.Write("<script>alert('对不起，用户名不存在！可能已经被管理员删除了。');javascript:history.back();</script>")
Response.End
end if
rsget("user_pass")=MD5(trim(replace(request.form("pass"),"'","")))
rsget.update
Response.Write("<script>alert('恭喜您！您已经成功设置新密码！');this.location.href='index.asp';</script>")
Response.End
end if
rsget.close
set rsget=nothing
call foot%>
