<!--#Include File="inc/fso.asp"-->
<%
	response.buffer = true
	
	'检查访问的来源是否合法
	'call checkPrePage()
	
	'检查用户访问的权限
	call checkuser(0)

	dim startTime, endtime
	startTime = timer()

	Dim strSQLServer, strSQLUser, strSQLPassword, strSQLDataBase, strScriptFileSystem
	Dim objSenty
	dim conn
	dim connstr
	dim rs, rSub
	dim sql


'*****************************安装后请在此设置系统变量***********************************************

	strSQLServer="(local)"			'服务器名，请修改为你主机中SQL的服务器名
	strSQLUser="SQL用户名"					'用户名，请修改为你在SQL的用户名
	strSQLPassword="SQL密码"			'密码，请修改为你在SQL的用户的密码如没设密码应为""
	strSQLDataBase="数据库名称"				'SQL使用的数据库名，请修改为你在SQL在的使用数据库名
	strScriptFileSystem=Const_ScriptFileSystem					'FSO对象名称
	
'***************************************************************************************************

	connstr = "driver={SQL Server};server=" & strSQLServer & ";UID=" & strSQLUser & ";PWD=" & strSQLPassword & ";database=" & strSQLDataBase & ""
	set conn = server.createobject("ADODB.CONNECTION")

	if err.number<>0 then
		err.clear
		set conn=nothing
		response.write "<script>window.status=""创建 ADO 对象失败"";</script>"
		response.end
	else
		conn.open connstr

		if err.number<>0 then
			err.clear
			set conn=nothing
			response.write "<script>window.status=""SQL Server 数据库连接失败"";</script>"
					'''请检查数据库是否存在，以及 ODBC 是否存在
			response.end
		end if
	end if
	
	set rs = Server.CreateObject("ADODB.Recordset")     '主程序用
	set rSub = Server.CreateObject("ADODB.Recordset")   '子程序用
	
	'创建COMMAND对象，以执行存贮过程
	'Set cmd=Server.CreateObject("ADODB.Command")
	'cmd.ActiveConnection=conn
	'cmd.CommandType=adCmdStoredProc


	'记录用户常用属性
	Dim MemberLevel
	Select Case Trim(Session("UserCode"))
		Case "0"
			MemberLevel="普通会员"
		Case "1"
			MemberLevel="普通代理"
		Case "2"
			MemberLevel="高级代理"
		Case "3"
			MemberLevel="合作伙伴"
		Case "4"
			MemberLevel="战略伙伴"
		Case "5"
			MemberLevel="区域管家"
		Case "6"
			MemberLevel="总管家"
	End select

	HomePage="home/" & trim(Session("UserName")) & "/"
'+++++++++++++++++++++++++++++++上面这段为用户登录后要记录的COOKIES+++++++++++++++++++++++++++


	Sub objend()
		set rSub=nothing
		set rs=nothing
		conn.close
		set conn=nothing

		endtime=timer()
		response.write "<script>window.status=""执行时间：" &_
				FormatNumber((endtime-startTime)*1000,3) & " 毫秒"";" &_
				"setTimeout(""window.status='';"",2000);" &_
				"</script>"
	End Sub
	
		
	'函数功能：获取网站指定属性
	Function GetKey(strKeyName,strUserID,strType)
		strSQL="Select k_value From attrib Where m_id=" & strUserID & " And k_name='" & strKeyName & "' And k_type='" & strType & "'"
		set rsKey=Server.CreateObject("ADODB.RecordSet")
		rsKey.open strSQL,conn,1,1
		if rsKey.recordcount > 0 then
			GetKey=trim(rsKey("k_value"))
		else
			GetKey="Null"
		end if
	End Function
	
	'函数功能：设置网站指定属性
	Function SetKey(strKeyName,strKeyValue,strUserID,strType)
		strSQL="Select k_value From attrib Where m_id=" & strUserID & " And k_name='" & strKeyName & "' And k_type='" & strType & "'"
		set rsKey=Server.CreateObject("ADODB.RecordSet")
		rsKey.open strSQL,conn,1,1
		if rsKey.recordcount > 0 then
			'如果属性已在，则修改
			strSQL="Update attrib Set k_value='" & strKeyValue & "' Where m_id=" & strUserID & " And k_name='" & strKeyName & "' And k_type='" & strType & "'"
		else
			'如果不存在，则创建
			strSQL="Insert Into attrib(m_id,k_type, k_name, k_value) Values(" & strUserID & ",'" & strType & "','" & strKeyName & "', '" & strKeyValue & "')"
		end if
		conn.execute strSQL,0,1
	End Function

'判断访问来源，如果不是本部则无法访问
  sub checkPrePage()
	 url=request.ServerVariables("HTTP_REFERER")
	 url=trim(replace(url,"http://",""))
	 url=trim(left(url,len(request.ServerVariables("SERVER_NAME"))))
	 if url<>trim(request.ServerVariables("server_name")) then
	  ShowMsg "<strong><font color=red>严重警告：非法访问!</font></strong><br>以任何方式攻击、影响本站的正常运转都是一种犯法的行为，都将承担法律责任！"
	  response.End()
	 end if
  end sub

 sub checkuser(level)
 	if instr(",CHKLogin.asp,RegUser.asp,Templet.asp",thispage)>0  And thispage<>"" then exit sub
	
 	if Trim(Session("UserID"))=""  Or Trim(Session("UserName"))="" then
	  ShowMsg "<strong><font color=red>对不起，您尚未登录,或离开时间太长!<br>点击 [<a href=Login.asp>登录</a>] 重新登录。</font></strong><br>"
	end if
	
 	userlevel=Cint(Session("UserCode"))
	if userlevel<level then
	  ShowMsg "<strong><font color=red>对不起，您没有权限访问此页！</font></strong><br>以任何方式攻击、影响本站的正常运转都是一种犯法的行为，都将承担法律责任！"
	end if
 end sub

'提示系统信息
sub ShowMsg(msg)
	msg=server.URLEncode(msg)		'将字符串编码，以便做参数传递
	response.Redirect("error.asp?msg=" + msg)
end sub




'===========================专门用来过滤Request的参数值===================================			
function GetVariable(strVariableName)
	if IsEmpty(Request(strVariableName)) then
		GetVariable=empty
		exit Function
	end if
	GetVariable=Replace(Request(strVariableName),"'","''")
	GetVariable=Replace(GetVariable,";","")
	GetVariable=Replace(GetVariable,"--","")
end function
	

function GetFormVariable(strVariableName)
	if IsEmpty(Request.Form(strVariableName)) then
		GetFormVariable=empty
		exit Function
	end if
	GetFormVariable=Replace(Request.Form(strVariableName),"'","''")
	GetFormVariable=Replace(GetFormVariable,"--","")
end function
	
function GetQueryString(strVariableName)
	if IsEmpty(Request.QueryString(strVariableName)) then
		GetQueryString=empty
		exit Function
	end if
	GetQueryString=Replace(Request.QueryString(strVariableName),"'","''")
	GetQueryString=Replace(GetQueryString,";","")
	GetQueryString=Replace(GetQueryString,"--","")
end function

'===========================专门用来过滤Request的参数值===================================
			
%>