<!--#include file="inc/chr.asp"-->
<!--#include file="inc/conn.asp"-->
<%
dim ComeUrl,cUrl
ComeUrl=lcase(trim(request.ServerVariables("HTTP_REFERER")))
if ComeUrl="" then
	response.write "<br><p align=center><font color='red'>對不起，為了系統安全，不允許直接輸入地址訪問本系統的后臺管理頁面。</font></p>"
	response.end
else
	cUrl=trim("http://" & Request.ServerVariables("SERVER_NAME"))
	if mid(ComeUrl,len(cUrl)+1,1)=":" then
		cUrl=cUrl & ":" & Request.ServerVariables("SERVER_PORT")
	end if
	cUrl=lcase(cUrl & request.ServerVariables("SCRIPT_NAME"))
	if lcase(left(ComeUrl,instrrev(ComeUrl,"/")))<>lcase(left(cUrl,instrrev(cUrl,"/"))) then
		response.write "<br><p align=center><font color='red'>對不起，為了系統安全，不允許從外部鏈接地址訪問本系統的后臺管理頁面。</font></p>"
		response.end
	end if
end if
'/驗證系統用戶賬戶及管理密碼/
Dim rdsMember    	'/創建會員賬號訪問對象/
Dim sqlMember       '/創建SQL語句/
Dim strMember   	'/會員賬號/
Dim strPassWord  	'/管理密碼/
Dim sqlUpdateMember
strMember =changechr(Request.Form("userName"))
strPassWord =changechr(Request.Form("pswd"))
set rdsMember = Server.CreateObject("ADODB.Recordset")
sqlMember = "Select * From fyuser Where user = '"& strMember &"'"
rdsMember.Open sqlMember,Conn
if not rdsMember.EOF then
	if strPassWord = rdsMember("pass") then
		if rdsMember("sh") =1 then
			Session("boobuser") = strMember
			Session("boobpass") = strPassword
			Session("userid") = rdsMember("id")	
			Session("lx") = rdsMember("lx")	
			Session("jb") = rdsMember("jb")		
			
			sqlUpdateMember = "Update fyuser Set LoginCount = LoginCount + 1 Where id = "& rdsMember("id") &""
			Conn.Execute sqlUpdateMember
			
			Response.Redirect "index.asp"
		else
			Response.Write "<script>alert(""\對不起！您的會員帳號已被禁止登錄，請與管理員聯系！"");window.location='Javascript:history.back()';</script>"
		end if
	else
		Response.Write "<script>alert(""\您輸入的密碼不正確，請重新輸入！"");window.location='Javascript:history.back()';</script>"
	end if
else
	Response.Write "<script>alert(""\您輸入的會員帳號不存在，請重新輸入！"");window.location='Javascript:history.back()';</script>"
end if
rdsMember.Close
set rdsMember = nothing
%>