<%
dim AdminName,adminpassword
dim rsGetAdmin,sqlGetAdmin
dim ComeUrl,cUrl
ComeUrl=lcase(trim(request.ServerVariables("HTTP_REFERER")))
if ComeUrl="" then
	response.write "<br><p align=center><font color='red'>對不起，為了系統安全，不允許直接輸入地址訪問本系統的后臺管理頁面。</font></p>"
	response.end
else
	cUrl=trim("http://" & Request.ServerVariables("SERVER_NAME"))
	if mid(ComeUrl,len(cUrl)+1,1)=":" then
		cUrl=cUrl & ":" & Request.ServerVariables("SERVER_PORT")
	end if
	cUrl=lcase(cUrl & request.ServerVariables("SCRIPT_NAME"))
	if lcase(left(ComeUrl,instrrev(ComeUrl,"/")))<>lcase(left(cUrl,instrrev(cUrl,"/"))) then
		response.write "<br><p align=center><font color='red'>對不起，為了系統安全，不允許從外部鏈接地址訪問本系統的后臺管理頁面。</font></p>"
		response.end
	end if
end if

AdminName=replace(session("AdminName"),"'","")
adminpassword=session("adminpassword")
if AdminName="" then
	call CloseConn()
	response.redirect "Admin_login.asp"
end if
sqlGetAdmin="select id from Admin where UserName='" & AdminName & "' and password='"&adminpassword&"'"
set rsGetAdmin=server.CreateObject("adodb.recordset")
rsGetAdmin.open sqlGetAdmin,conn,1,1
if rsGetAdmin.bof and rsGetAdmin.eof then
	rsGetAdmin.close
	set rsGetAdmin=nothing
	call CloseConn()
	response.redirect "Admin_login.asp"
end if
rsGetAdmin.close
set rsGetAdmin=nothing

sub copyright()
	response.Write "<div align='center'>Blog １２３,Copyright&copy; 2004  All Rights Reserved.<BR><BR></div>"
end sub
%>