<!--#include file="../inc/conn.asp"-->
<!--#include file="../inc/md5.asp"-->
<%
linkurl=request.servervariables("http_referer")
bbsuser=trim(request.form("bbsuser"))
password=request.form("password")
useryz=trim(request.form("useryz"))

for i=1 to len(bbsuser)
cl=mid(bbsuser,i,1)
if cl="'" or cl="<" or cl=">" or cl="%" or cl="/" or cl="-" then
   response.write "<script language='javascript'>"
   response.write "alert('密码中不能有非法字符！!');"
   response.write "history.go(-1);"
   response.write "</script>"
   response.end  
end if
next

for i=1 to len(password)
pwd=mid(password,i,1)
if pwd="'" or pwd="<" or pwd=">" or pwd="%" or pwd="/" or pwd="#" or pwd="$" or pwd="-" then
   response.write "<script language='javascript'>"
   response.write "alert('密码中不能有非法字符！!');"
   response.write "history.go(-1);"
   response.write "</script>"
   response.end 
end if
next

'if cstr(session("getcode"))<>cstr(useryz) then
   'response.write "<script language='javascript'>"
   'response.write "alert('验证码输入有误!请核对!');"
   'response.write "history.go(-1);"
   'response.write "</script"
   'response.end
'end if
str="select * from clubuser where clubuser_name='"&bbsuser&"' and clubuser_password='"&md5(password)&"'"
set rs=server.createobject("adodb.recordset")
rs.open str,conn,3,1
if rs.eof then
   response.write "<script language='javascript'>"
   response.write "alert('用户名或密码错误，请重新登录！');"
   response.write "history.go(-1);"
   response.write "</script>"
   response.end
else

session("bbsuser")=rs("clubuser_nickname")
session("name")=rs("clubuser_name")'用户名
session("bbsadmin")=rs("bbsadmin")
session("bbs_email")=rs("clubuser_email")
session("bz")=rs("bbsmanager")
session("payuser")=rs("payuser")

'设置cookies
Response.Cookies("bbsuser")=rs("clubuser_nickname")'昵称
Response.Cookies("name")=rs("clubuser_name")'用户名
Response.Cookies("bz")=rs("bbsmanager")
Response.Cookies("bbsadmin")=rs("bbsadmin")
Response.Cookies("payuser")=rs("payuser")

Response.Cookies("bbsuser").Expires=date+Cint(Request.Form("ckies"))
Response.Cookies("name").Expires=date+Cint(Request.Form("ckies"))
Response.Cookies("bbsadmin").Expires=date+Cint(Request.Form("ckies"))
Response.Cookies("bz").Expires=date+Cint(Request.Form("ckies"))
Response.Cookies("payuser").Expires=date+Cint(Request.Form("ckies"))

if request.cookies("payuser")=3 then
   response.write "<script language='javascript'>"
   response.write "alert('对不起,你的用户名被管理员封锁了!');"
   response.write "history.go(-1);"
   response.write "</script>"
   response.end
end if
'修改用户最后登录时间、登录次数
sql="update clubuser set clubuser_lasttime='"&now()&"',tili=tili+100 where clubuser_name='"&trim(request.form("bbsuser"))&"'"
conn.execute(sql)

response.write "<script language='javascript'>"
response.write "window.location.href='"&linkurl&"';"
response.write "parent.left.document.location.reload();"
response.write "</script>"
response.end 
'response.redirect linkurl
end if
%>