-----------------代码主要实现，验证用户名和密码的正确性
=====================并实现。确认用户权限的验证 manage =1为管理员
<!--#include file="conn.asp"-->
<%
dim username,userpass
'接收表单数据
username=trim(replace(request("username"),"'",""))
userpass=trim(Request.Form("userpass"))
'取得客户端IP
userip=Request.ServerVariables("REMOTE_ADDR")
%>
<%
Set rs = Server.CreateObject("ADODB.Recordset")
sql="Select * From users where username='" &username&"'"&"and userpass='"&userpass&"'"
rs.Open sql, conn, 3,3
%>
<%if rs.bof or rs.eof then %>
<script language=javascript>
alert( "错误：此用户名不存在！" );
location.href = "javascript:history.back()"
</script>
<%else if userpass<>rs("userpass") then%>
<script language=javascript>
alert("错误：您的密码不正确！");
location.href = "javascript:history.back()"
</script>
<%rs=close
set rs=nothing
%>
<%else ' 登录成功%>
<%
'------------------------新建 rs2查询用户权限
Set rs2 = Server.CreateObject("ADODB.Recordset")
sql2="Select manage From users where username='"&username&"'"
rs2.Open sql2, conn, 3,3
'记录修改最后登录时间and IP
sql="update users set LastLogintime=now(),LastLoginip='" &userip& "' where username='" &username&"'"
conn.execute(sql)
%>
<%
'验证成功以后，就可以建立session对象咯~~
if rs("manage")=1 then '管理员权限
session("username")=rs("username")
session("userpass")=rs("userpass")
response.redirect "manage.asp"
else
session("username")=rs("username")
session("userpass")=rs("userpass")
response.redirect "select.asp"
end if
rs2.close
set rs2=nothing
set conn=nothing
%>
</script>
<%end if%>
=========请教一下，这样设计有问题吗？还有更简单，经典的方法实现相同功能吗=======
[此贴子已经被作者于2007-11-11 2:21:15编辑过]
