<!--#include file="conn.asp"-->
<!--#include file="b2b_sys.asp"-->
<%
dim username,UserPassword,comeurl,passcode
username=FormatSQL(replace(trim(request.form("username")),"'",""))
UserPassword=md5(FormatSQL(replace(trim(request.Form("UserPassword")),"'","")))
if not isnumeric(request.form("passcode")) then
response.Write "<script LANGUAGE='javascript'>alert('登录失败！验证码必须是数字，请正确填写！');history.go(-1);</script>"
conn.Close
set conn=nothing
response.end
end if
passcode=Cint(request.form("passcode"))
comeurl=request.servervariables("HTTP_REFERER")
if comeurl="" then
comeurl="index.asp"
end if
if username="" or UserPassword="" then
response.Write "<script LANGUAGE='javascript'>alert('登录失败！请检查您的登录名和密码！');history.go(-1);</script>"
conn.Close
set conn=nothing
response.end
end if

if passcode<>Session("GetCode") then
response.Write "<script LANGUAGE='javascript'>alert('登录失败！验证码错误！');history.go(-1);</script>"
conn.Close
set conn=nothing
response.end
end if

set rs=server.CreateObject("adodb.recordset")
rs.Open "select * from [user] where UserPassword='"&UserPassword&"' and username='"&username&"' " ,conn,1,3
if not(rs.bof and rs.eof) then

if UserPassword=rs("UserPassword") and passcode=Session("GetCode") then
response.Cookies("Buy2Buy")("username")=trim(request.form("username"))
session("chklogin1")=1
session("uid")=rs("userid")
session("username1")=rs("username")
session("dengji")=rs("grpid")
rs("LastLogin")=now()
rs("UserLogins")=rs("UserLogins")+1
rs("Img") = Request.ServerVariables("REMOTE_ADDR")
rs.Update
rs.Close
set rs=nothing
conn.Close
set conn=nothing
response.redirect comeurl
else
response.write "<script LANGUAGE='javascript'>alert('登录失败，请检查您的登录名和密码！');history.go(-1);</script>"
rs.Close
set rs=nothing
conn.Close
set conn=nothing
response.end
end if

else
response.write "<script LANGUAGE='javascript'>alert('登录失败！请检查您的登录名和密码！');history.go(-1);</script>"
rs.Close
set rs=nothing
conn.Close
set conn=nothing
response.end
end if
%>
