<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%>
<% Option Explicit %>
<%Response.Charset="utf-8"%>
<!--#include file="Include/Const.asp"-->
<!--#include file="Include/ConnSiteData.asp"-->
<!--#include file="Include/Md5.asp"-->
<!--#include file="Include/SafeFunction.asp"-->
<%
If Request.QueryString("Action")="Out" Then
   Session.Contents.Remove "MemName"
   Session.Contents.Remove "GroupID"
   Session.Contents.Remove "GroupLevel"
   Session.Contents.Remove "MemLogin"
   Response.Redirect CStr(Request.ServerVariables("HTTP_REFERER"))
   Response.End
End If

Public ErrMsg(3)
   ErrMsg(0)="·登录名不正确，请返回。"
   ErrMsg(1)="·登录密码不正确，请返回。"
   ErrMsg(2)="·帐号非使用状态，请返回。"

Dim LoginName, LoginPassword, VerifyCode, MemName, Password, GroupID, GroupName, Working, rs, sql
Dim cmd

' 安全过滤用户输入
LoginName = SqlSafe(Trim(Request.Form("LoginName")))
LoginPassword = Md5(Request.Form("LoginPassword"))

' 使用参数化查询防止SQL注入
Set cmd = Server.CreateObject("ADODB.Command")
cmd.ActiveConnection = conn
cmd.CommandText = "SELECT * FROM F_Yang_Members WHERE MemName=?"
cmd.CommandType = 1
cmd.Parameters.Append cmd.CreateParameter("@MemName", 200, 1, 50, LoginName)
Set rs = cmd.Execute

If rs.BOF And rs.EOF Then
   WriteMsg(ErrMsg(0))
   Response.End
Else
   MemName = rs("MemName")
   Password = rs("Password")
   GroupID = rs("GroupID")
   GroupName = rs("GroupName")
   Working = rs("Working")
End If
rs.Close
Set rs = Nothing
Set cmd = Nothing

If LoginPassword <> Password Then
   WriteMsg(ErrMsg(1))
   Response.End
End If 

If Not Working Then
   WriteMsg(ErrMsg(2))
   Response.End
End If 
 
If UCase(LoginName) = UCase(MemName) And LoginPassword = Password Then
   ' 更新登录信息
   Set cmd = Server.CreateObject("ADODB.Command")
   cmd.ActiveConnection = conn
   cmd.CommandText = "UPDATE F_Yang_Members SET LastLoginTime=?, LastLoginIP=?, LoginTimes=LoginTimes+1 WHERE MemName=?"
   cmd.CommandType = 1
   cmd.Parameters.Append cmd.CreateParameter("@Time", 135, 1, , Now())
   cmd.Parameters.Append cmd.CreateParameter("@IP", 200, 1, 50, Request.ServerVariables("Remote_Addr"))
   cmd.Parameters.Append cmd.CreateParameter("@Name", 200, 1, 50, MemName)
   cmd.Execute
   Set cmd = Nothing
   
   Session("MemName") = MemName
   Session("GroupID") = GroupID
   
   ' 获取用户组权限
   Set cmd = Server.CreateObject("ADODB.Command")
   cmd.ActiveConnection = conn
   cmd.CommandText = "SELECT GroupLevel FROM F_Yang_MemGroup WHERE GroupID=?"
   cmd.CommandType = 1
   cmd.Parameters.Append cmd.CreateParameter("@GroupID", 200, 1, 50, GroupID)
   Set rs = cmd.Execute
   If Not (rs.BOF And rs.EOF) Then
      Session("GroupLevel") = rs("GroupLevel")
   End If
   rs.Close
   Set rs = Nothing
   Set cmd = Nothing
   
   Session("MemLogin") = "Succeed"
   Session.Timeout = 60
   Response.Redirect "MemberInfo.asp"
   Response.End
End If
%>