<!--#include file="conn.asp"-->
<!--#include file="ConnUser.asp"-->
<!--#include file="config.asp"-->
<!--#include file="char.inc"-->
<!--#include file="md5.asp"-->
<!--#include file="ChkURL.asp"-->

<%
verifycode9=checkstr(request.form("verifycode9"))
if request.cookies(echsys)("key")<>"" then%>
<!--#include file="ChkUser.asp"-->
<%end if
author=ChkRequest(request("guestname"),0)	'防注入
if  verifycode9<>session("verifycode9") then
Show_Err("对不起，请输入正确的用户名、密码及验证码。<br><br><a href='javascript:history.back()'>返回</a>")
else

reviewid=ChkRequest(request("reviewid"),1)	'防注入
password=md5(trim(request("password")))
if Instr(request("guestname"),"=")>0 or Instr(request("guestname"),"%")>0 or Instr(request("guestname"),chr(32))>0 or Instr(request("guestname"),"?")>0 or Instr(request("guestname"),"&")>0 or Instr(request("guestname"),";")>0 or instr(request("guestname"),",")>0 or Instr(request("guestname"),"'")>0 or Instr(request("guestname"),",")>0 or Instr(request("guestname"),chr(34))>0 or Instr(request("guestname"),chr(9))>0 or Instr(request("guestname"),"")>0 or Instr(request("guestname"),"$")>0 then
	Show_Err("对不起，您输入的用户名中包含有非法字符。<br><br><a href='javascript:history.back()'>返回</a>")
	response.end
end if

Set rs=Server.CreateObject("Adodb.RecordSet")
rs.Open "Select * from "& db_User_Table &" where "& db_User_Name &"='"&author&"'",ConnUser
if not rs.EOF then
	if password<>rs(db_User_Password) then			''验证修改者密码
		if request.cookies(echsys)("key")<>"super" then 	''判断是否是超级用户在修改,不是则提示密码
			Show_Err("对不起，密码输入错误！<br><br><a href='javascript:history.back()'>返回</a>")
			Response.End 
		end if
	end if
	user=true
end if
rs.close
set rs=nothing

shengfen=checkstr(request.form("shengfen"))
ComeFrom=checkstr(request.form("ComeFrom"))
homepage=checkstr(request.form("homepage"))
reviewip=checkstr(Request.serverVariables("REMOTE_ADDR"))
oicq=checkstr(request.form("oicq"))
face=checkstr(request.form("face"))
title=checkstr(request.form("title"))
content=trim(htmlencode1((request.form("content"))))
content=replace(content,"<p> ","")
content=replace(content,"<P> ","")
qqh=(request.form("qqh"))

Response.cookies(echsys)("content")=content

dim byte1
byte1=split(byteType,"|")

for i=0 to ubound(byte1)
	content=replace(content,trim(byte1(i)),"***")
next

dim byte2
byte2=split(byteipType,"|")

for i=0 to ubound(byte2)
if Request.serverVariables("REMOTE_ADDR")=byte2(i) then
	Show_Err("对不起，你的IP地址已被锁定，请联系管理员！！！。<br><br><a href='javascript:history.back()'>返回</a>")
	Response.cookies(echsys)("content")=""
	Response.End 
end if
next

dim byte3
byte3=split(bytezfType,"|")

for i=0 to ubound(byte3)
if Instr(request("content"),byte3(i))>0  then
	Show_Err("对不起，请不要发布非法小广告！！！。<br><br><a href='javascript:history.back()'>返回</a>")
	Response.cookies(echsys)("content")=""
	Response.End 
end if
next

if Instr(request("content"),"'")>0 or Instr(request("content"),"script")>0 or Instr(request("content"),"onClick")>0  or Instr(request("content"),"onload")>0 then
	Show_Err("对不起，您输入的留言内容包含有非法字符。<br><br><a href='javascript:history.back()'>返回</a>")
	Response.End 
end if

if content="" then
	Show_Err("留言内容不能为空，请输入留言内容！<br><br><a href='javascript:history.back()'>返回</a>")
	Response.End
end if

if user=true then
	set rs=server.createobject("adodb.recordset")
	sql="select * from "& db_User_Table &" where "& db_User_Name &"='"&author&"'"
	rs.open sql,ConnUser,1,3
	email=rs(db_User_Email)
	if UserTableType="EChuang" then
		face=rs(db_User_Face)
	else
		if UserTableType="Dvbbs" then			''判断是否整合论坛
			face=(BbsPath+rs(db_User_Face))		''注册用户头像定位到论坛路径
		end if
	end if
	rs.close
	set rs=nothing
else
	email=trim(request.form("email"))
end if

if reviewid="" then
	set rs=server.createobject("adodb.recordset")
	sql="select * from "& db_wygkcn_Review_Table &"" 
	rs.open sql,conn,1,3
	rs.addnew
	rs("author")=author
	rs("content")=content
	rs("shengfen")=shengfen
	rs("ComeFrom")=ComeFrom		
	rs("homepage")=homepage
	rs("reviewip")=reviewip
	rs("email")=email
	rs("oicq")=oicq
	rs("face")=face
	rs("title")=title
	rs("updatetime")=now()
	rs("EC_ArticleID")=qqh
	if reviewcheck=1 then		'根据评论默认审核状态进行留言审核状态的设置
		rs("passed")=1
	else
		rs("passed")=0
	end if
	rs.update
	rs.close
	set rs=nothing
	
else
	set rs=server.createobject("adodb.recordset")
	sql="select * from "& db_wygkcn_Review_Table &" where reviewid="&reviewid 
	rs.open sql,conn,1,3
	if not rs.eof then
		rs("author")=author
		rs("content")=content
		rs("shengfen")=shengfen
		rs("ComeFrom")=ComeFrom
		rs("homepage")=homepage
		rs("reviewip")=reviewip
		rs("email")=email
		rs("oicq")=oicq
		rs("title")=title
		if user=true then			''判断所修改留言帐号是否是注册用户,是则重新取头像位置
			rs("face")=face
		end if
		rs("updatetime")=now()
		
		rs("EC_ArticleID")=qqh
		rs.update
	end if
	rs.close
	set rs=nothing
	Response.cookies(echsys)("content")=""
end if
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="gb2312">
<head>
<title>留言成功__<%=eChSys_Com%></title>
<meta http-equiv=refresh content="1;url=wygkcn_GuestBook.asp">
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="CSS/Wygkcn_Home.css" rel=stylesheet type=text/css>
<LINK href="CSS/Wygkcn_News.css" rel="stylesheet" type=text/css>
</head>
<body>
<!--内容部分开始-->
<div id="EC_Content">
<!--#include file="Top.asp"-->
<!--位置导航部分开始-->
<div class="position">
<img src="Images/lm_dot.gif" width="11" height="11">&nbsp;&nbsp;您的位置&nbsp;&nbsp;<a href="./" >首页</a> >> <a href="wygkcn_Conmunicate.asp">交流互动</a> >> <a href="wygkcn_GuestBook.asp">留言咨询</a> >>留言成功</div>
<!--位置导航部分结束-->
<!--中间内容部分开始-->
<div class=back>
             留言成功<br />
			 <a href="wygkcn_GuestBook.asp">返回</a>
</div>
<!--中间内容部分结束-->

<!--#include file="bottom.asp"-->
<%end if%>
<%Response.cookies(echsys)("content")=""
'response.redirect "wygkcn_GuestBook.asp"%>
</div>
<!--内容部分结束-->
</body>
</html>