[ÇóÖú]ÓüǵǼ

Ò¹Á÷±ù

<%
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from denglu where name='"&name&"' and pwd='"&pwd&"'" ,conn,1,1

if request.Form("name")="" then
response.Write"<script language=javascript>alert('ÇëÊäÈëÓû§Ãû');history.back(-1);</script>"
response.End()
end if
if request.Form("pwd")="" then
response.Write"<script language=javascript>alert('ÇëÊäÈëÃÜÂë');history.back(-1);</script>"
response.End()
end if
name=trim(request.Form("name"))
pwd=trim(request.Form("pwd"))
if rs.eof then
response.Write"<script> alert('Óû§Ãû»òÃÜÂë²»ÕýÈ·');history.back(-1);</script>"
response.End()
else
session("name")=rs("name")
session("pwd")=rs("pwd")
response.Redirect"1.asp"
end if
rs.close
set rs=nothing
cn.close
set cn=nothing
%>
Õâʲô²»¶ÁÈ¡Êý¾Ý¿âÖеÄÊý¾Ý¿âÄØ

ľ×Ó

ÕâÖÖ±à³Ì·ç¸ñÒª²»µÃ¡£
1.´úÂëÁèÂÒ
2.ÎÞÖØÓü¼Êõ
3.˳Ðò·¢Éú´íÎó¡£
»¹ÊÇÔÚ×ö֮ǰÀíÒ»ÏÂÄãµÄ˼·°É

Ò¹º®

cn.close
set cn=nothing

cnÄÄÀïÀ´µÄ£¿

¨ã½A¿f¤Îo¥¡

ÄǸöÊÇÊý¾Ý¿âÁ¬½Ó¡£¡£

»¹ÓÐ1Â¥µÄ£¬ÄãÕâÑùд²»ÐÐ

set rs=server.CreateObject("adodb.recordset")
rs.open "select * from denglu where name='"&name&"' and pwd='"&pwd&"'" ,conn,1,1

Ó¦¸Ã·ÅÔÚÊäÈëÖµÅжϺó£¬ÕâÑùÿ´Î¶¼È¥ÅжÏÒ»´Î£¬ÄãҲûȥ¹Ø±ÕÊý¾Ý¿âÁ¬½Ó¡£¡£

»¹ÓÐһЩעÈëµÄÅжÏҲû¼Ó ÎÒÒ»¸ö admin or 1=1 ' Äã¾ÍûµôÁË£¡