<!--#INCLUDE FILE="conn.asp" -->
<!--#INCLUDE file="inc/MD5.asp" -->
<!--#INCLUDE file="inc/msgbox.asp" -->
<%
page="../" & request.QueryString("page")
if page="../" then
page=request.form("url")
end if
if left(page,4)="..//" then
page=left(page,3)+mid(page,5,len(page))
end if
if page="" then
page=request.serverVariables("Http_REFERER")
end if

if request.QueryString("online")="quit" then
session("user_id")=""
session("user_admin")=""
session("user_name")=""
session("user_type")=""
Response.redirect page
end if 
if not request.form("userid") ="" then 
'  if session("user_id")="" then 
    userid=request.form("userid") 
    password=request.form("password")  
    exec="select * from [user] where userID='"+userid+"'" 
    set rs=server.createobject("adodb.recordset")  
    rs.open exec,conn,1,3 
   if rs.RecordCount=0 then
                msgbox "对不起，您输入的用户不存在！","back"
   else 
       if MD5(password)=rs("password") then  
           session("user_id")= userid
           session("user_name")=rs("username")
           session("user_type")=rs("type")
	   rs("lastdate")=now()
           rs("ids")=rs("ids")+1
           rs.update
           session("times")=rs("ids")
           Response.redirect page                                                     
           
        else                                                 
           msgbox "您输入的密码有错误！","back"
        end if                                                                               
   end if  
rs.close
set rs=nothing                                                 
'end if
else
msgbox "非法请求","back"                                               
end if 
conn.close
set conn=nothing                                            
%>          
