<!--#include file="../conn.asp"-->
<!--#include file="../Plus/md5.asp"-->
<%
'不缓存
Response.Cachecontrol = "no-cache"
Response.Addheader "pragma", "no-cache"
Response.Expires = -1
Response.ExpiresAbsolute = Now - 1
Response.Charset = "GB2312"
Response.Addheader "Content-Type", "text/html; charset=gb2312"

Dim Rs, Md5Key, ID, UserName, RealName, TradeNo, Money


'========================================================================================================================
'以下配置参数可随意修改，建议不定期更换密钥
'========================================================================================================================
Const mKey = "W#I7#9sW65fK#*RDE@"                      '密钥 需与充值软件设置的保持一致
Const mIP = ""                                          '只允许特定IP访问，支持IP段 如192.168.1.*  空则无限制
Const mPG = 0                                           '会员充值成功是否扣手续费，0为不扣除 例如要扣0.5%手续费则改为0.5
'========================================================================================================================
'========================================================================================================================


Call CheckIP
Select Case Request("Action")
    Case "Success"
            Call DoSuccess
    Case "Fail"
            Call DoFail
    Case Else
            Call DoReadOrder
End Select

'充值失败
Sub DoFail()
    ID = Left(DelSql(Request("TID")), 7)
    TradeNo = Left(DelSql(Request("TradeNo")), 30)
    Money = Left(DelSql(Request("Money")), 10)
    Md5Key = Left(Request("Md5Key"), 32)
    If ID = "" Or TradeNo = "" Or Money = "" Or Md5Key = "" Or MD5(ID & TradeNo & Money & "Fail" & mKey, 32) <> Md5Key Then
        Response.End
    Else
        If Not IsNumeric(Money) Then Response.End
        Set Rs = Server.CreateObject("ADODB.Recordset")
        Rs.Open "SELECT Status, EndDate FROM AutoCZ WHERE TradeNo = '" & TradeNo & "' And Money = " & Money & " And ID = " & ID, Conn, 1, 3
        If Not (Rs.EOF And Rs.Bof) Then
            Rs("Status") = 2
            Rs("EndDate") = Now
            Rs.Update
            Response.Write "Fail"
        Else
            Response.Write "Fail Not ID"
        End If
        Rs.Close
        Set Rs = Nothing
    End If
    Response.End
End Sub

'充值成功
Sub DoSuccess()
    ID = Left(DelSql(Request("TID")), 7)
    TradeNo = Left(DelSql(Request("TradeNo")), 30)
    Money = Left(DelSql(Request("Money")), 10)
    Md5Key = Left(Request("Md5Key"), 32)
    If ID = "" Or TradeNo = "" Or Money = "" Or Md5Key = "" Or MD5(ID & TradeNo & Money & "Success" & mKey, 32) <> Md5Key Then
        Response.End
    Else
        If Not IsNumeric(Money) Then Response.End
        Set Rs = Server.CreateObject("ADODB.Recordset")
        Rs.Open "SELECT * FROM AutoCZ WHERE TradeNo = '" & TradeNo & "' And Money = " & Money & " And Status = 0 And ID = " & ID, Conn, 1, 3
        If Not (Rs.EOF And Rs.Bof) Then
            Rs("Status") = 1
            Rs("EndDate") = Now
            UserName = Rs("UserName")
            RealName = Rs("RealName")
            Rs.Update
            If mPG > 0 Then
                Money = Money - Money * mPG / 100
            End If
            Conn.Execute ("Update KS_User Set Money = Money + " & Money & " Where UserName = '" & UserName & "'")
            Conn.Execute ("Insert Into KS_LogMoney([UserName],[ClientName],[Money],[MoneyType],[IncomeOrPayOut],[OrderID],[Remark],[PayTime],[LogTime],[Inputer],[IP],[CurrMoney],[ChannelID],[InfoID],[Times]) Values('" & UserName & "','" & RealName & "'," & Money & ",2,1,'" & TradeNo & "','支付宝转账自动充值,交易号：" & TradeNo & "'," & SqlNowString & "," & SqlNowString & ",'系统','" & Request.ServerVariables("REMOTE_ADDR") & "'," & Conn.Execute("SELECT Money FROM KS_User WHERE UserName = '" & UserName & "'")(0) & ",0,0,1)")
            Response.Write "Success"
        Else
            Response.Write "Success Not ID"
        End If
        Rs.Close
        Set Rs = Nothing
    End If
    Response.End
End Sub

'读单
Sub DoReadOrder()
    Dim SoftName: SoftName = Request("SoftName")
    If SoftName <> "HSK_Soft" Then Response.End
    Set Rs = Conn.Execute("SELECT TOP 1 ID, TradeNo, Money FROM AutoCZ WHERE (Status = 0)")
    If Not (Rs.EOF And Rs.Bof) Then
        Response.Write Rs("ID") & "|" & Rs("TradeNo") & "|" & Rs("Money")
    Else
        Response.Write "No"
    End If
    Set Rs = Nothing
    Response.End
End Sub

'判断IP
Sub CheckIP()
    If mIP <> "" Then
        Dim strIP, bolFind, intX, strTemp
        strIP = Request.ServerVariables("REMOTE_ADDR")
        bolFind = False
        strSplit = Split(mIP, "|")
        For intX = 0 To UBound(strSplit)
                strTemp = Trim(strSplit(intX))
                If strTemp <> "" Then
                        If strIP = strTemp Then
                                bolFind = True
                                Exit For
                        ElseIf Right(strTemp, 1) = "*" And Left(strIP, Len(strTemp) - 1) = Left(strTemp, Len(strTemp) - 1) Then
                                bolFind = True
                                Exit For
                        End If
                End If
        Next
        If Not bolFind Then
                Response.Write "不允许访问"
                Response.End
        End If
    End If
End Sub

'过滤SQL注入字符
Function DelSql(Str)
    Dim SplitSqlStr, SplitSqlArr, I
    SplitSqlStr = "%|dbcc|alter|drop|*|and |exec|or |insert|select|delete|update|count |master|truncate|declare|char|mid|chr|set |where|xp_cmdshell"
    SplitSqlArr = Split(SplitSqlStr, "|")
    For I = LBound(SplitSqlArr) To UBound(SplitSqlArr)
        If InStr(LCase(Str), SplitSqlArr(I)) > 0 Then
            Response.End
        End If
    Next
    DelSql = Str
End Function

%>
