<% strpassword=ReplaceString(Request("password")) sid = ReplaceString(Request("id")) logout = ReplaceString(Request("logout")) code = ReplaceString(Request("code")) If logout = "logout" Then response.cookies("board_id") = "" Response.Redirect "list.asp?code="& code else sql="select * from p_manager where M_ID='"& sid &"'" set rs=server.createobject("ADODB.Recordset") rs.open sql,db,1 if rs.eof or rs.bof then %> <% elseif rs("M_PWD") <> strpassword then %> <%else rs.close db.close set rs = nothing set db = nothing response.cookies("board_id") = "board_admin" Response.Redirect "list.asp?code="& code end if end If %>