<!--#include file="adminconn.asp" -->
<!--#include file="include/md5.asp"-->
<%

Dim Usr,Pwd,rs
Usr=Request.form("admin") '从表单获得数据
Pwd=Request.form("password") '同上
if (Usr<>"") and (Pwd<>"") then '判断数据为非空
	Usr=Replace(Replace(Usr,"'",""),"or","") '嵌套了两个replace函数，过滤特殊字符
	Pwd=Replace(Replace(Pwd,"'",""),"or","")
	if cstr(Session("GetCode"))<>cstr(Trim(Request("code"))) then
	Response.Write("<script>alert(""错误：\n您输入的确认码和系统产生的不一致，请重新输入。\n返回后请刷新登录页面后重新输入正确的信息"");location.href=""index.asp"";</script>")
	Response.End
	end if
set rs=server.createobject("adodb.recordset")
rs.open "select * from admin where admin='" & Usr & "' and password='"&Md5(Pwd)&"'",conn,1
if rs.eof and rs.bof then
	response.write"<script language=javascript>alert('用户名或密码不正确！');"
	response.write"javascript:history.go(-1)</script>"
	response.end
else
	session("userid")=rs("admin")
	session("adminuser")=rs("admin")
	session("password")=rs("password")
	session("aleave")=rs("aleave")
	session("userkey")=rs("userkey")
	session("strbigidtype")=replace(rs("bigclassauthorize")," ","")
	session("strsmallidtype")=replace(rs("smallclassauthorize")," ","")
	session("login")=true
	response.redirect "manage.asp"
end if
	rs.close
	set rs=nothing
	conn.close
	set conn=nothing
else
	response.redirect "index.asp"
end if
%>