<!--#include file="conn.asp"-->
<%
	const ThisPage = "Admin_EditColumn.asp"	
	Dim strContent,fs,HTMLFile
	strM_ID=Trim(Session("UserID"))

	Set fs = Server.CreateObject( Const_ScriptFileSystem )
	
	if Lcase( Trim(GetVariable("action")) ) = "update" then
		call SaveUpdate()
	end if
	
	'如果选择了下次直接进入内容模式
	if Lcase(GetVariable("Mode"))="true" then
		Session("EditMode")="1"
	end if
%>
<%
	'保存内容
	sub SaveUpdate()
		strContent=Replace(request.Form("content"),"'","''")
			
		'禁止使用CreateObject
		if instr(Lcase(strContent),"createobject")>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，请不要在此使用服务器端的组件服务！"
		end if
			
		'禁止使用<object>创建组件
		if instr(Lcase(strContent),"runat=")>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，请不要在此使用服务器端的组件服务！"
		end if
		
		'禁止使用ASP代码
		if instr(strContent,"<" & chr(37) )>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，禁止插入服务器运行脚本代码！"
		end if
			
		'转换ASP代码
		strContent=aspEndReplace(strContent)
		
	
		strSQL="Update menu set mn_content='" & strContent & "' Where id=" & GetVariable("mnid")
		conn.execute strSQL,0,1
		
		'生成文件
		strSQL="Select mn_href From menu Where id=" & GetVariable("mnid")
		set rsMenu=Server.CreateObject("ADODB.RecordSet")
		rsMenu.open strSQL,conn,1,1
		
		if rsMenu.recordcount>0 then
			HTMLFile=Server.MapPath( "home/" & Trim(Session("UserName")) & "/" & trim(rsMenu("mn_href")))
		end if
		rsMenu.close
		set rsMenu=nothing
		
		if fs.FileExists(HTMLFile) then
			call SaveContent(HTMLFile)
		end if
		
		'保存完毕
		strSaveMsg="----保存成功!!"
	end sub


sub SaveContent(fileHTML)
	'打开文件，并取得网页HTML代码
	set objTextFile=fs.OpenTextFile(fileHTML,1)
	strHTMLText=objTextFile.ReadAll

	objTextFile.close
	
	'替换内容<!--Content Beging-->和<!--Content End-->之间的内容
	Dim BeforeContent,AfterContent
	pn=instr(strHTMLText,"<!--Content Beging-->")
	if pn>0 then
		BeforeContent=left(strHTMLText,pn+20)
	end if
					
	pn=instr(strHTMLText,"<!--Content End-->")
	if pn>0 then
		AfterContent=Right(strHTMLText,len(strHTMLText)-pn+1)
	end if

	'==========================只替换Body部份===================================
	strHTMLText=BeforeContent & vbCrLf & strContent & vbCrLf & AfterContent
			
	'替换完毕，写回文件
	set objTextFile=fs.OpenTextFile(fileHTML,2)
	objTextFile.WriteLine strHTMLText
	objTextFile.close
	Set objTextFile = nothing
end sub

%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>电子商务自助建站--您理想的助手</title>
<link href="common/styleMain.css" rel="stylesheet" type="text/css">
</head>
<body leftmargin="0" topmargin="0">
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td align="center"><table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
        <tr> 
          <td height="0" align="center">
		  <!--#include file="common/Editortop.asp"-->
          </td>
        </tr>
        <tr> 
          <td height="100%" align="center">
		  <!--网页在线编辑器Begin-->
			<table border=0 cellpadding=0 cellspacing=0 class=table002>
			<tbody>
			  <tr>
				<td width="100%" valign="top" align="center">
				  <table bgcolor="#FFFFFF" border="0" cellspacing="0" cellpadding="0" width="98%">
				<tr>
				  <td><b>内容编辑模式：<%=GetVariable("title")%></b>
					<b><font color="#FF0000"><%=strSaveMsg%></font></b>
					<hr size="1">
				  </td>
				<tr>
				<tr>
				  <td width="100%" valign="top">
				<%
					dim mnid,strSaveMsg
					mnid=GetVariable("mnid")
					if mnid="" then
						ShowMsg "访问的栏目不存在，无法编辑！"
					end if
					
					'取得相应栏目的内容编辑
					strSQL="Select mn_content From menu Where id=" & mnid
					Set rs=Server.CreateObject("ADODB.RecordSet")
					rs.open strSQL,conn,1,1
					if rs.recordcount<=0 then
						ShowMsg "访问的栏目不存在，无法编辑！"
					end if
					
					HtmlEditContent = trim(rs("mn_content"))
					
					EditorHeight = 450
			
		HtmlEditContent=aspStartReplace(HtmlEditContent)

		HtmlEditContent=Server.HTMLEncode(HtmlEditContent)
				%>
			
				<form name="HtmlEditForm" action="<%=ThisPage%>?action=Update&mnid=<%=mnid%>&title=<%=GetVariable("title")%>" method=post>
                            <table width="100%" border="0" cellpadding="1" cellspacing="1" align="center" bgcolor="aaaaaa">
                              <input type=hidden name=Handle value="<%=intHandle%>">
                              <tr bgcolor="ffffff" valign="middle"> 
                                <td width="25" align="center"> <textarea name="content" style="display:none"><%=HtmlEditContent%></textarea> 
                                  <iframe ID="eWebEditor1" src="/editor/ewebeditor.asp?id=content&style=standard" frameborder="0" scrolling="no" width="100%" HEIGHT="420"></iframe></td>
                              </tr>
                              <tr bgcolor="#FFFFFF" height="25"> 
                                <td align="center" valign="middle"><input type="submit" name="Submit1" value=" 提 交 " id="Submit1"> 
                                  &nbsp; <input type="reset" name="Submit2" value=" 清 除 "></td>
                              </tr>
                            </table>
                          </form>
				  </td>
				</tr>
				  </table>
				</td>
			  </tr>
			  </tbody>
			</table>
		  <!--网页在线编辑器END-->
		  </td>
        </tr>
        <tr> 
          <td height="0" align="center">
		  <!--#include file="common/bottom.asp"-->
		  </td>
        </tr>
      </table></td>
  </tr>
</table>
<%

'--------------------------------------------转换ASP代码-----------------------------------------------
	Dim intHandle		'本次操作把柄
	Function aspStartReplace(strContent)
		'生成操作号
		Randomize 									'初始化随机数生成器。
		intHandle = Int((100000000 * Rnd))			' 产生随机数。
		
		Dim i,sPn,ePn
		i=0
		'开始循环替换ASP代码并记录到数据库
		sPn=Instr(strContent,"<" & chr(37))
		Do While sPn>0
			ePn=Instr(strContent,chr(37) & ">")
			i=i+1
			strReplace="⑨ASP代码" & i & "⑨"
			strASPCode=Mid(strContent, sPn, ePn+2-sPn)
			'替换成代号
			strContent=Replace(strContent,strASPCode,strReplace)
			'记录到数据库
			strASPCode=Replace(strASPCode,"'","''")
			strSQL="Insert Into aspcode(m_id,a_handle,a_index,a_aspcode) Values(" & strM_ID & "," & intHandle & "," &  i & ",'" & strASPCode & "')"
			conn.execute strSQl,0,1
			
			'为下次循环准备
			sPn=Instr(strContent,"<" & chr(37))
		loop
		
		'替换include file=top.asp
		strContent=Replace(strContent,"<!--" & chr(35) & "include file=""top.asp""-->","⑨Include⑨")
		
		'返回替换后结果
		aspStartReplace=strContent
	End Function
	
	Function aspEndReplace(strContent)

		strSQL="Select * From aspcode Where a_handle=" & GetFormVariable("Handle") & " And m_id=" & strM_ID & " Order by a_index"
		Set rsSub=Server.CreateObject("ADODB.RecordSet")

		rsSub.open strSQL,conn,1,1
		for i=1 to rsSub.recordcount
			strContent=replace(strContent,"⑨ASP代码" & rsSub("a_index") & "⑨",Trim(rsSub("a_aspcode")))
			rsSub.movenext
		next
		rsSub.close
		set rsSub=nothing
		
		'替换include file=top.asp
		strContent=Replace(strContent,"⑨Include⑨","<!--" & chr(35) & "include file=""top.asp""-->")
		
		aspEndReplace=strContent
	End Function
'--------------------------------------------转换ASP代码-----------------------------------------------
	
%>
</body>
</html>
