<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<!--#include file=DataBase/conn.asp-->
<%
'校對驗證碼是否正確
if trim(request("num"))<>trim(request("num1")) then
	response.Write("<script language=javascript>alert('驗證碼不正確');location='login.asp'</script>")
	response.End()
end if
'判斷用戶名是否為空
if trim(request("admin_name"))="" then
	response.Write("<script language=javascript>alert('用戶名不能為空');location='login.asp'</script>")
	response.End()
end if
'判斷密碼是否為空
if trim(request("admin_pwd"))="" then
	response.Write("<script language=javascript>alert('密碼不能為空');location='login.asp'</script>")
	response.End()
end if
if request("action")="login" then
	admin_name=request("admin_name")
	admin_pwd=request("admin_pwd")
	username=trim(replace(request("admin_name"),"'",""))
	userpwd=trim(replace(request("admin_name"),"'",""))
	'判斷用戶名中是否含有非法字符
	for i=1 to len(username)
	user=mid(username,i,1)
	if user="'" or user="%" or user="<" or user=">" or user="&" or user="|" then
	response.write "<script language=JavaScript>" & "alert('您的用戶名含有非法字符,請重新輸入！');" & "history.back()" & "</script>"
	response.end
	end if
	next
	'判斷密碼中是否含有非法字符
	for i=1 to len(userpwd)
	pass=mid(userpwd,i,1)
	if pass="'" or pass="%" or pass="<" or pass=">" or upass="&" or pass="|" then
	response.write "<script language=JavaScript>" & "alert('您的密碼含有非法字符,請重新輸入！');" & "history.back()" & "</script>"
	response.end
	end if
	next
		   
	set rs=server.CreateObject("adodb.recordset")
	sql="select * from tb_User where username='"&admin_name&"' and userpwd='"&admin_pwd&"'"
	rs.open sql,conn,1,1
	if not rs.eof then 
	session("admin_name")=username
	response.Redirect("index.asp")
	else
	response.Write("<script language=javascript>alert('您輸入的用戶名或者密碼有誤，請重新輸入！');location='javascript:history.go(-1)'</script>")
	end if
end if
%>