<!--#include file="../inc/conn.asp"-->
<!--#include file="../inc/md5.asp" -->
<%
username=trim(request.form("username"))
password=trim(request.form("password"))

for i=1 to len(username)
cl=mid(username,i,1)
if cl="'" or cl="<" or cl=">" or cl="%" or cl="/" or cl="-" or cl="#" or cl="$" then
   response.write "<script langugae=javascript>alert('请输入正确的用户名！');"
   response.write "window.location.href='index.asp';</script>"
   response.end   
end if
next

for i=1 to len(password)
pwd=mid(password,i,1)
if pwd="'" or pwd="<" or pwd=">" or pwd="%" or pwd="/" or pwd="#" or pwd="$" or pwd="-" then
   response.write "<script langugae=javascript>alert('密码中不能有非法字符！');"
   response.write "window.location.href='index.asp';</script>"
   response.end   
end if
next

useryz=trim(request.form("useryz"))
if cstr(session("getcode"))<>cstr(useryz) then
   response.write "<script language='javascript'>"
   response.write "alert('验证码输入有误!请核对!');"
   response.write "history.go(-1);"
   response.write "</script>"
   response.end
end if

set rs=server.createobject("adodb.recordset")
str="select * from clubuser where clubuser_name='"&username&"' and clubuser_password='"&md5(password)&"' and bbsadmin=1"
rs.open str,conn,3,1
		if rs.eof then
           response.write "<script langugae=javascript>alert('用户名或密码不正确！');"
           response.write "window.location.href='index.asp';</script>"
           response.end 
		else
			session("clubuser_id")=rs("clubuser_id")
            session("bbsadmin")=rs("bbsadmin")
            session("bbsuser")=rs("clubuser_nickname")'昵称
            session("name")=rs("clubuser_name")'用户名
			session("bz")=rs("bbsmanager")
			session("payuser")=rs("payuser")
			
            Response.Cookies("bbsuser")=rs("clubuser_nickname")'昵称
            Response.Cookies("name")=rs("clubuser_name")'用户名
            Response.Cookies("bz")=rs("bbsmanager")
            Response.Cookies("bbsadmin")=rs("bbsadmin")
			Response.Cookies("payuser")=rs("payuser")
			'系统默认保留一天
			Response.Cookies("bbsuser").Expires=date+1
			Response.Cookies("name").Expires=date+1
			Response.Cookies("bbsadmin").Expires=date+1
			Response.Cookies("bz").Expires=date+1
			Response.Cookies("payuser").Expires=date+1
			'++++++++++++++++++++++++++
			sql1="Update clubuser set clubuser_enter_count=clubuser_enter_count+1,clubuser_lasttime='"&now()&"' where clubuser_id="& rs("clubuser_id")
			Conn.Execute(sql1)
			rs.close
			set rs=nothing
			response.redirect "manage.asp"
		end if
conn.close
set conn=nothing
%>