<!--#include file="Admin.asp" -->
<!--#include file="cf.asp" -->
<!--#include file="adminconn.asp" -->
<!--#include file="../include/safe.asp"-->
<!--#include file="include/md5.asp"-->
<%
'==================================
'----------------------------------------------------------------------

'----------------------------------------------------------------------
if session("admin")=request.form("admin") or session("aleave")="super" then
	admin=request.form("admin")
	password=request.form("password")
	aleave=request.form("aleave")
	bigclassauthorize=request.form("bigclassauthorize")
	smallclassauthorize=request.form("smallclassauthorize")

if session("aleave")="super" then
	if bigclassauthorize=""  then
	response.write"<script language=javascript>alert('栏目管理权限为空请检查');"
	response.write"javascript:history.go(-1)</script>"
	response.end
	end if
end if

set rs=server.createobject("adodb.recordset")

if request("act")="edit" and request.querystring("id")<>"" then
	if admin="" then
		response.write"<script language=javascript>alert('管理员名称不能为空！');"
		response.write"javascript:history.go(-1)</script>"
		response.end
	end if
	id=request("id")
	sql="select * from admin where id="& request.querystring("id")
	rs.open sql,conn,3,2
	if not rs.eof then
		if session("userkey")<>10 then
			rs("aleave")=aleave
		end if
	rs("admin")=admin
	if password<>"" then
		rs("password")=md5(password)
	end if
if session("aleave")="super" then
	rs("bigclassauthorize")=bigclassauthorize
	if smallclassauthorize=""  then
		rs("smallclassauthorize")=0
	else
		rs("smallclassauthorize")=smallclassauthorize
	end if
end if
rs.update
end if
rs.close
elseif request("acction")="add" then
if admin="" or password="" then
response.write"<script language=javascript>alert('管理员名称和密码都不能为空！');"
response.write"javascript:history.go(-1)</script>"
response.end
end if
Usr=Replace(Replace(admin,"'",""),"or","") '嵌套了两个replace函数，过滤特殊字符
Pwd=Replace(Replace(password,"'",""),"or","")
sql="select * from admin where admin='"&Usr&"'"
rs.open sql,conn,3,2
if (rs.eof and rs.bof) then
	rs.addnew
	rs("aleave")=aleave
	rs("admin")=Usr
	rs("password")=md5(Pwd)
	rs("bigclassauthorize")=bigclassauthorize
	if smallclassauthorize=""  then
		rs("smallclassauthorize")=0
	else
		rs("smallclassauthorize")=smallclassauthorize
	end if
	if aleave="super" then
		rs("userkey")=9
	else
		rs("userkey")=1
	end if
rs.update
else
	response.Write "对不起，用户已存在！"
end if
rs.close
end if
set rs=nothing
conn.close
set conn=nothing
response.redirect "admin_admin.asp"
response.End()
else
response.write"<script language=javascript>alert('对不起，你没有这个权限！');"
response.write"javascript:history.go(-1)</script>"
response.end
end if
%>