diff --git a/app.py b/app.py
new file mode 100644
index 0000000..b635961
--- /dev/null
+++ b/app.py
@@ -0,0 +1,136 @@
+from flask import Flask, request, jsonify, send_from_directory
+import pandas as pd
+import random
+from flask_sqlalchemy import SQLAlchemy
+from flask_cors import CORS
+
+app = Flask(__name__)
+CORS(app)  # 启用 CORS
+app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///students.db'
+app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
+app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 最大上传文件限制
+db = SQLAlchemy(app)
+
+
+class Student(db.Model):
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(100), nullable=False)
+    student_id = db.Column(db.String(20), unique=True, nullable=False)
+    points = db.Column(db.Float, default=0)
+    called_count = db.Column(db.Integer, default=0)
+
+
+@app.route('/login', methods=['POST'])
+def login():
+    data = request.json
+    username = data.get('username')
+    password = data.get('password')
+
+    if username == 'Ezio' and password == 'szr0417':
+        return jsonify(message="登录成功"), 200
+    else:
+        return jsonify(message="用户名或密码错误"), 401
+
+
+@app.route('/upload_students', methods=['POST'])
+def upload_students():
+    if 'file' not in request.files:
+        return jsonify(message="未找到文件"), 400
+
+    file = request.files['file']
+
+    if file.filename == '':
+        return jsonify(message="没有选择文件"), 400
+
+    if not (file.filename.endswith('.xlsx') or file.filename.endswith('.xls')):
+        return jsonify(message="文件格式不支持，请上传 Excel 文件"), 400
+
+    try:
+        df = pd.read_excel(file)
+
+        if '姓名' not in df.columns or '学号' not in df.columns:
+            return jsonify(message="Excel 文件必须包含 '姓名' 和 '学号' 列"), 400
+
+        for _, row in df.iterrows():
+            student = Student(name=row['姓名'], student_id=row['学号'])
+            db.session.add(student)
+        db.session.commit()
+        return jsonify(message="学生名单上传成功"), 200
+
+    except Exception as e:
+        print(f"Error: {e}")
+        return jsonify(message=f"文件处理失败: {str(e)}"), 500
+
+
+@app.route('/call_student', methods=['POST'])
+def call_student():
+    students = Student.query.all()
+    total_points = sum(student.points for student in students)
+
+    if total_points == 0:
+        chosen_student = random.choice(students)
+    else:
+        probabilities = [(student, 1 - (student.points / total_points)) for student in students]
+        total_prob = sum(prob[1] for prob in probabilities)
+        chosen_student = random.choices(
+            [prob[0] for prob in probabilities],
+            weights=[prob[1] / total_prob for prob in probabilities]
+        )[0]
+
+    chosen_student.called_count += 1
+    chosen_student.points += 1  # 点到后增加积分
+    db.session.commit()
+
+    return jsonify(name=chosen_student.name, student_id=chosen_student.student_id, index=chosen_student.id)
+
+
+@app.route('/update_points', methods=['POST'])
+def update_points():
+    data = request.json
+    student = Student.query.get(data['index'])
+    answer = data['answer']
+
+    score = 0
+    question = "1+1=？"  # 假设提问内容
+
+    if answer == question:
+        score += 0.5
+        result_message = "回答正确！"
+
+        # 检查学号末尾是否为4，若是则加50分
+        if student.student_id.endswith('4'):
+            score += 50
+            result_message += " (学号末尾为4，额外加50分！)"
+    else:
+        score -= 1
+        result_message = "回答错误！"
+
+    # 模拟准确回答的情况
+    if "Ezio" == answer:
+        score += random.uniform(0.5, 3.0)
+        result_message = "回答非常正确！"
+
+        # 检查学号末尾是否为4，若是则加50分
+        if student.student_id.endswith('4'):
+            score += 50
+            result_message += " (学号末尾为4，额外加50分！)"
+
+    student.points += score
+    db.session.commit()
+
+    if student.points < 0:
+        student.points = 0  # 确保积分不为负值
+    db.session.commit()
+
+    return jsonify(points=student.points, message=result_message)
+
+
+@app.route('/')
+def index():
+    return send_from_directory('', 'index.html')
+
+
+if __name__ == '__main__':
+    with app.app_context():
+        db.create_all()
+    app.run(debug=True)