<!--#include file="function/DBOpen.asp"-->
<% 
dim rs,sql
dim reviewable
dim reviewer,email,url,content
set rs=server.createobject("adodb.recordset")         '查找是否開放評論權限
rs.open "select * from news_parameter where parameterid=1",conn,1,1
if not rs.bof and not rs.eof then
	if rs("reviewable")<>1 then
        rs.close
		response.write "對不起,評論功能已被管理員關閉!!!<a href='index.html'>返回</a>"
		response.end
	end if
end if
rs.close
set rs=nothing

function invert(str) 
    invert=replace(replace(replace(replace(str,"<","&lt;"),">","&gt;"),chr(13),"<br>")," ","&nbsp;") 
    invert=replace(replace(replace(replace(invert,"[img]","<img src="),"[b]","<b>"),"[red]","<font color=red>"),"[blue]","<font color=blue>") 
    invert=replace(replace(replace(replace(invert,"[/img]","></img>"),"[/b]","</b>"),"[/red]","</font>"),"[/blue]","</font>") 
end function

reviewer=trim(request("reviewer"))
email=trim(request("email"))
url=trim(request("url"))
content=invert(request("content"))
if url="http://" then
  url="" 
end if
if email<>"" then
  if instr(email,"@")<2 or len(email)<8 or instr(email,".")<5 then
    response.write"錯誤!!您的電子郵件填寫不規范!!!<a href=""javascript:history.go(-1)"">返回</a>"
    response.end
  end if
end if
if url<>"" then
  if instr(url,".")<1 then
	  response.write"錯誤!!您的主頁地址填寫不規范!!!<a href='javascript:history.go(-1)'>返回</a>"
      response.end
  end if
  isnot=" !@$^*()'`|[]}{;<>"
  for i=1 to len(url)
    for j=1 to len(isnot)
	  if mid(url,i,1)=mid(isnot,j,1) then
	    response.write"錯誤!!您的主頁地址填寫不規范!!!<a href='javascript:history.go(-1)'>返回</a>"
        response.end
	  end if
    next
  next
end if

    if reviewer="" or trim(request("content"))="" then 
	    response.write "錯誤!!帶<font color=red>*</font>號的為必填項<a href='javascript:history.go(-1)'>返回</a>!!"
		response.end
	else
		set rs=server.createobject("adodb.recordset")
        rs.open "select * from review",conn,1,3
		rs.addnew
		rs("newsid")=cstr(request("newsid"))
		rs("reviewer")=reviewer
	    rs("uip")=request("remote_addr")
		rs("email")=email
		rs("url")=url
		rs("content")=content
		rs.update
		rs.close
		set rs=nothing
	end if
response.redirect "review.asp?newsid=" & request("newsid")
%>

<!--#include file="function/DBclose.asp"-->