<% option explicit %>
<!--#include file="function/DBOpen.asp"-->
<%
  if request("username")<>"" and request("userpassword")<>"" then 
      dim name
      dim pwd
	  dim sql
	  dim rs
	  name=request.form("username")
	  pwd=request.form("userpassword")
	  if instr(name,"'")<>0 or instr(pwd,"'")<>0 then
		  response.redirect "main.asp"
		  response.end
	  end if
	  set rs = server.createobject("adodb.recordset")
	  sql="select * from viplist where vip_name='" & name & "' and password='" & pwd & "'"
      rs.open sql,conn,1,1
	  if err.number <> 0 then
	      response.write "数据库操作失败："&err.description
		  response.end
	  else
		  if not rs.eof and not rs.bof then
	          session("department")=rs("department")
			  session("name")=rs("vip_name")
			  session("asborderid")=rs("asborderid")
			  response.redirect "vip_showlist.asp"
          end if
	  end if
	  rs.close
	  set rs=nothing
  end if
  response.redirect "main.asp"
%>
<!--#include file="function/DBClose.asp"-->