login.asp

网上购物系统 asp+sql server 2005

<!--#include file="include/dbopenbd.asp"-->
<!--#include file="md5.asp"-->
<%
call check_path()   '保证此页的调用是合法的

'获取上页传递的信息，aspsql对信息进行安全处理，防止用sql注入法控制数据库
Userid=aspsql(request.form("userid"))  '用户名
Password=aspsql(request.form("password"))   '密码
cook=cint(request.form("cook"))   'cookies期限
'提交标记
if request.form("Login")<>"ok" then response.redirect "main.asp"
if Userid = "" or Password ="" then response.redirect "error.asp?error=004"
if Userid = request.cookies("buyok")("userid") then response.redirect "error.asp?error=005"
if session("byzm")&""<>trim(request.form("yzm")) then mGoBack "验证码错误。"&request.form("yzm")
sql = "select * from s_buser where userid='"&Userid&"'"
Set rs=Server.CreateObject("ADODB.RecordSet") 
rs.open sql,conn,1,3
'用户不存在
if (rs.bof and rs.eof) then mGoBack "用户不存在。"
'用户被锁定
if rs("Status")<>"正常" and rs("Status")<>"1" then mGoBack "出错了，您的会员号已被锁定或者未通过审核。"
'用户密码错误
if  rs("UserPassword")<> md5(Password) then
session("login_error")=session("login_error")+1
mGoBack "您输入的密码不正确，请检查后重新输入。\n\n出错 "&session("login_error")&" 次"
else
'登陆成功
	'记录登陆时间
	rs("lastlogin")=now()  
	'记录登陆IP
	rs("IP")=Request.serverVariables("REMOTE_ADDR")
	'记录总登陆次数
	rs("TotalLogin")=rs("TotalLogin")+1
	rs.update
	'登陆用户名保存到全局变量中
	response.cookies("buyok")("userid")=lcase(userid)
	'cookies有限时间设定
	if request.form("cook")<>"0" then response.cookies("buyok").expires=now+cook
	'如果已经购买商品，将购物清单弹出
	if request.cookies("buyok")("cart")<>"" then
	  response.write "<script>"
	  response.write "window.open('order/check.asp','blank_','scrollbars=yes,resizable=no,width=650,height=450')"
	  response.write "</script>"
	end if
	'转入到会员中心
	response.write "<meta http-equiv='refresh' content='0;URL=user_center.asp'>"
end if
rs.close
set rs=nothing
%>