preorder.asp

fger th t ytwety w4t qrt 43 q34rt5 q34t3q4t

<!--#include file="config.inc"-->
<%
  '此函数用来将sql语句中的单引号转换为双引号 
   function sqlstr(data)
     sqlstr="'" & Replace(data,"'","''") & "'"
   end function
'连接数据库
  set conn=server.createobject("adodb.connection")
  conn.open connstring
  
  set objusersrs=server.createobject("adodb.recordset")
  '检查用户名与密码是否正确
  userid=trim(request.form("userid"))
  userpw=trim(request.form("userpw"))
    
  sql="select * from users where userid="
  sql=sql&sqlstr(userid)&" and userpw="
  sql=sql&sqlstr(userpw)

  objusersrs.open sql,conn,1,3
  if objusersrs.eof then '没有找到用户
     response.write "<font style=""font:10pt"">用户名/密码错误！</font>"
     response.end
  end if
  '找到用户
  productname=trim(request.form("productname"))
  nametag=trim(request.form("nametag"))
  descrip=trim(request.form("descrip"))
  '打开预定制商品信息表
  set objpreordersrs=server.createobject("adodb.recordset")
  objpreordersrs.open "select * from preorders",conn,1,3
  '把用户预定的商品信息插入到数据库中，并同时记录下预定该商品的用户的资料
  objpreordersrs.addnew
    objpreordersrs(0)=userid
    objpreordersrs(1)=productname
    objpreordersrs(2)=nametag
    objpreordersrs(3)=descrip
    objpreordersrs(4)=now
  objpreordersrs.update

objusersrs.close
objpreordersrs.close
conn.close
set conn=nothing
response.redirect "prefill.asp?result=success"
%>