<!-- #include file="opendb.asp"-->
<%
  if Trim(session("mangflag"))="" or Trim(session("timeflag"))="" then
    Response.redirect("noadmto.asp")
  end if
%>
<%
'------------------- 解决留言不会换行的-----------------------
  function HTMLEncode(fString)
  if not isnull(fString) then
  fString = replace(fString, ">", "&gt;")
  fString = replace(fString, "<", "&lt;")

  fString = Replace(fString, CHR(32), "&nbsp;")
  fString = Replace(fString, CHR(9), "&nbsp;")
  fString = Replace(fString, CHR(34), "&quot;")
  fString = Replace(fString, CHR(39), "&#39;")
  fString = Replace(fString, CHR(10) & CHR(10), "</P><P> ")
  fString = Replace(fString, CHR(10), "<BR> ")
  HTMLEncode = fString
  end if
  end function
%>
<%
  'if Trim(Request.Form("")
%>
<%
  if Trim(Request.Form("Recontent"))="" then
%>	
<%
  else
'------------------- v 1.4 解决留言不会换行的Bug-----------------------
    recontent = HtmlEncode(Request.form("Recontent"))

'------------------- v 3.0 Security Encode -----------------------
  	recontent = SecEncode( recontent )

	On Error Resume Next

    set Rs=Server.CreateObject("ADODB.Recordset")
    sqlstrb="select * from reply Where GuestID="&Trim(Request("ID"))
    Rs.open sqlstrb,conn,1,3

	If Err.Number=0 Then
    Rs.addnew
	  Rs("GuestID")	=Trim(Request("ID"))
	  Rs("Date")	=Date()
	  Rs("Time")	=Time()
	  Rs("Content")	=recontent
	  Rs("RName") 	="管理员"
	  If Request.Form("SecReply")="1" Then
	    Rs("SecReply")=True
	  Else
	    Rs("SecReply")=False
	  End If
    Rs.update
	End If
  
  SQL = "Update Guest Set Reply=1 Where ID=" & Request("ID")
  Conn.Execute(SQL)	  
%>
<%
  End if
  conn.close
  set conn=nothing
%>
<% 
  urlstr="state.asp?state=replysuc&pn="+Trim(Request("pn"))
  response.Redirect urlstr
%>
