?using System;
using System.Data;
using System.Data.OleDb;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;

public partial class Admin_Admin_Login : System.Web.UI.Page
{
    OleDbConnection MyConn;
    protected void Page_Load(object sender, EventArgs e)
    {
        if(!IsPostBack)
        {
            this.UserName.Text = "";
            this.UserPwd.Text = "";
        }
    }
    protected void ImageButton1_Click(object sender, ImageClickEventArgs e)
    {
        MyConn = DB.CreateDB();
        MyConn.Open();
        string UserName = FunStr(Request.Form["UserName"].ToString());
        string UserPwd = FunStr(Request.Form["UserPwd"].ToString());
        OleDbCommand cmd = new OleDbCommand("select count(*) from admin where admin='" + UserName + "' and pwd='" + UserPwd + "'", MyConn);
        int count = Convert.ToInt32(cmd.ExecuteScalar());
        if (count > 0)
        {
            Session["UserID"] = this.UserName.Text;
            Response.Redirect("Admin_Main.aspx");
        }

        else
        {
            Response.Write("<script language=javascript>window.alert('請您正確輸入');window.location.href=('Admin_Login.aspx');</script>");
        }
        MyConn.Close();
    }
    public static string FunStr(string str)
    {
        str = str.Replace("&", "&amp;");
        str = str.Replace("<", "&lt;");
        str = str.Replace(">", "&gt");
        str = str.Replace("'", "''");
        str = str.Replace("*", "");
        str = str.Replace("\n", "<br/>");
        str = str.Replace("\r\n", "<br/>");
        //str   =   str.Replace("?","");   
        str = str.Replace("select", "");
        str = str.Replace("insert", "");
        str = str.Replace("update", "");
        str = str.Replace("delete", "");
        str = str.Replace("create", "");
        str = str.Replace("drop", "");
        str = str.Replace("delcare", "");
        str = str.Replace("   ", "&nbsp;");

        str = str.Trim();
        if (str.Trim().ToString() == "")
            str = "無";
        return str;
    } 
}