UC知道麻烦修改密码验证漏洞
来源：百度知道 编辑：UC知道 时间：2024/05/07 03:58:15
以下是原程序，请将修改的程序完整的给出，不要光指点！
<%@LANGUAGE="VBSCRIPT"%>
<!--#include file="Connections/conn.asp" -->
<%
if Request.Form("SubBtn")="确 定" then
Set rs=Server.CreateObject("ADODB.RecordSet")
SqlText="SELECT A.UserID, A.UserNO, A.Password, A.UserName, A.DeptID,B.Dept_Code,A.Tel, B.DeptName FROM dbo.[User] A INNER JOIN dbo.Department B ON A.DeptID = B.DeptID WHERE A.IsSystem=1 AND A.UserName='"&trim(request.form("UserName"))&"' AND A.Password='"&trim(request.form("password"))&"'"
rs.open sqltext,cn,1,3
if rs.recordcount>0 then
Session("UserName")=Trim(rs("UserName"))
Session("DeptID")=Trim(rs("DeptID"))
Session("UserID")=Trim(rs("UserID"))
Session("UserNO")=Trim(rs("UserNO"))
Session("
<%@LANGUAGE="VBSCRIPT"%>
<!--#include file="Connections/conn.asp" -->
<%
if Request.Form("SubBtn")="确 定" then
Set rs=Server.CreateObject("ADODB.RecordSet")
SqlText="SELECT A.UserID, A.UserNO, A.Password, A.UserName, A.DeptID,B.Dept_Code,A.Tel, B.DeptName FROM dbo.[User] A INNER JOIN dbo.Department B ON A.DeptID = B.DeptID WHERE A.IsSystem=1 AND A.UserName='"&trim(request.form("UserName"))&"' AND A.Password='"&trim(request.form("password"))&"'"
rs.open sqltext,cn,1,3
if rs.recordcount>0 then
Session("UserName")=Trim(rs("UserName"))
Session("DeptID")=Trim(rs("DeptID"))
Session("UserID")=Trim(rs("UserID"))
Session("UserNO")=Trim(rs("UserNO"))
Session("
如果是ACCESS的数据库将SqlText改为如下:
SqlText="SELECT A.UserID, A.UserNO, A.Password, A.UserName, A.DeptID,B.Dept_Code,A.Tel, B.DeptName FROM dbo.[User] A INNER JOIN dbo.Department B ON A.DeptID = B.DeptID WHERE A.IsSystem=1 AND A.UserName='"&trim(Replace(request.form("UserName")，"'",""))&"' AND A.Password='"&trim(Replace(request.form("password"),"'","")")&"'"
如果是MSSQL的数据库还要将 - / * ( ) 过滤掉
密码最好用MD5加密
思考了一下 密码不用过滤 但建议你用MD5加密
下面代码中密码未用MD5加密函数
<%@LANGUAGE="VBSCRIPT"%>
<!--#include file="Connections/conn.asp" -->
<%
if Request.Form("SubBtn")="确 定" then
Set rs=Server.CreateObject("ADODB.RecordSet")
SqlText="SELECT A.UserID, A.UserNO, A.Password, A.UserName, A.DeptID,B.Dept_Code,A.Tel, B.DeptName FROM dbo.[User] A INNER
JOIN dbo.Department B