/**

     *  检验用户是否正确     *     * @access    public     * @param     string    $username  用户名     * @param     string    $userpwd  密码     * @return    string     */    function checkUser($username, $userpwd)    {         global $dsql;

        //只允许用户名和密码用0-9,a-z,A-Z,'@','_','.','-'这些字符

        $this->userName = preg_replace("/[^0-9a-zA-Z_@!\.-]/", '', $username);        $this->userPwd = preg_replace("/[^0-9a-zA-Z_@!\.-]/", '', $userpwd);        $pwd = substr(md5($this->userPwd), 5, 20);        $dsql->SetQuery("SELECT admin.*,atype.purviews FROM ` admin LEFT JOIN ` atype ON atype.rank=admin.usertype WHERE admin.userid LIKE '".$this->userName."' LIMIT 0,1");        $dsql->Execute();        $row = $dsql->GetObject();        if(!isset($row->pwd))        {             return -1;        }        else if($pwd!=$row->pwd)        {             return -2;        }        else        {             $loginip = GetIP();            $this->userID = $row->id;            $this->userType = $row->usertype;            $this->userChannel = $row->typeid;            $this->userName = $row->uname;            $this->userPurview = $row->purviews;            $inquery = "UPDATE ` SET loginip='$loginip',logintime='".time()."' WHERE id='".$row->id."'";            $dsql->ExecuteNoneQuery($inquery);            $sql = "UPDATE SET logintime=".time().", loginip='$loginip' WHERE mid=".$row->id;            $dsql->ExecuteNoneQuery($sql);            return 1;        }    }