<%session.Timeout = 333%>
<!--#include file="inc/Conn.asp"-->
<!--#include file="inc/md5.asp"-->
<%
	dim mSql,rs
	dim mUserName,mPassword

	mUserName=replace(replace(replace(replace(Trim(Request.Form("txtUserName")),"'","")," ",""),chr(13),""),"select","") 
	mPassword=Trim(Request.Form("txtPassword"))
	mSql="Select F_UserName,F_PassWord,F_LoginCount,type from fyasp_admin Where F_UserName='" & mUserName & "'"
    set rs=server.createobject("adodb.recordset")
    rs.open mSql,conn,1,1
		if rs.bof and rs.eof then
		    response.write "<script>alert('對不起，該用戶不存在！');history.back();</Script>"
            response.end			
	    else
			if md5(mPassword)<>rs("F_PassWord") or mUserName<>rs("F_UserName") then
			    response.write "<script>alert('對不起，請輸入正確的站長口令。！');history.back();</Script>"
			else
				Session("curUserName") = mUserName
				session("curAddtime") = now()
				session("curLoginCount") = rs("F_LoginCount")
				Session("master") = mUserName
				Session("type") =rs("type")
				mIPInfo=request.ServerVariables("REMOTE_HOST")
				mSql="update fyasp_admin set F_LoginCount=F_LoginCount+1,F_AddTime='"&now&"',F_IPInfo='"&mIPInfo&"' Where F_UserName='" & rs("F_UserName") &"'"
				conn.execute(mSql)
				if Request("action")="Expir" then 
				   Response.Redirect "Admin_Exit.asp"
				else
				   Response.Redirect "Admin_Main.asp"
				end if
				
			end if
		end if
    rs.close
	set rs=nothing
	conn.close
	set conn=nothing
%>