<!--#include file="connection.asp"-->

<%
dim xuid,xpass,checkpass
xuid = request("userid")
xpass = request("pass")

if instr(1,xuid,"'") > 0 then
	xuid = replace(xuid,"'","''")
end if
if instr(1,xpass,"'") > 0 then
	xpass = replace(xpass,"'","''")
end if

conn.open = connstring
set rs = conn.execute ( "Select count(pass) from reportusers where pass = '" & xpass & "' and userid = '" & xuid & "'")
if (len(xpass) = 0) or (len(xuid) = 0) then 
    	response.redirect "R_er_login.htm"
else
		if (rs(0) >= 1) then
			set rs = conn.execute ( "Select * from reportusers where userid = '" & xuid & "'")
			checkpass = rs("pass")
			if not(xpass=checkpass) then 
	    		response.redirect "R_er_login.htm"
			end if
			session("Ruserid") = xuid
			Response.Redirect "reportsmain.asp"			
		else
			Response.Redirect "R_er_login.htm"
		end if
end if


%>