m0_58675142 2021-05-27 21:38 采纳率: 100%
浏览 103
已采纳

修改为SQL参数化查询防止SQL注入

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="AdminLogin.aspx.cs" Inherits="AdminLogin" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title>网站信息管理</title>
    <link href="AdminCss/Logincss.css" rel="stylesheet" type="text/css" />
</head>
<body>
    <form id="form1" runat="server">
    <div id="log_fm">
        <div class="log_box">
            <div class="btn_box">
                <div id="tb_1">
                    <asp:TextBox ID="userName" runat="server" CssClass="tb"></asp:TextBox>
                </div>
                
                <div id="tb_2">
                    <asp:TextBox ID="passWord" runat="server" CssClass="tb"  TextMode="Password"></asp:TextBox>
                </div>
                
                <div id="tb_3">
                    <asp:TextBox ID="txtCode" runat="server" CssClass="tb_yz" ></asp:TextBox>
                </div>
                
                <div id="yz">
                    <asp:Image ID="Image1" runat="server" ImageUrl="~/Admin/RandomImage.aspx" />
                </div>
             
                
                <div id="btn_1">
                    <asp:Button ID="Button1" runat="server" Text="登录" CssClass="btn" 
                        Font-Size="14px" onclick="Button1_Click"  />
                </div>
                    
                <div id="btn_2">
                    <asp:Button ID="Button2" runat="server" Text="重置" CssClass="btn"
                     Font-Size="14px" />
                </div>
            </div>
        </div>
    </div>
    </form>
</body>
</html>
using System;
using System.Collections;
using System.Configuration;
using System.Data;
using System.Data.OleDb;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;

public partial class AdminLogin : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
       
    }

    protected void Button1_Click(object sender, EventArgs e)
    {
        string strConnnection = @"Provider=Microsoft.Jet.OLEDB.4.0;Data Source=";
        strConnnection += Server.MapPath("~/App_Data/DataMaster.mdb");
        OleDbConnection conn = new OleDbConnection(strConnnection);
        string cmdText = "SELECT COUNT(*) FROM [Admin] WHERE UserName='" + userName.Text + "' AND userPass='" + passWord.Text + "'";
        OleDbCommand cmd = new OleDbCommand(cmdText, conn);
        conn.Open();
        int count = (int)cmd.ExecuteScalar();
        conn.Close();
        
        if (string.Compare(Session["CheckCode"].ToString(), this.txtCode.Text, true) == 0  && count >0)
        {
            Session["myuser"] = userName.Text;
            Response.Write("<script>alert('登录成功!')</script>");
            ClientScript.RegisterStartupScript(this.GetType(), "e", "<script>window.location.href='Main.aspx';</script>");
            return;
        }
        else
        {
            Response.Write("<script>alert('输入错误!')</script>");
            ClientScript.RegisterStartupScript(this.GetType(), "e", "<script>window.location.href='AdminLogin.aspx';</script>");
        }
    }
}

代码如上，主要是防止SQL注入，要求代码可以直接上传服务器使用，不能有语法错误。

还有就是Web.config中  <customErrors mode="On" defaultRedirect="index.aspx"/>  这样设置是不是就不会显示WEB服务器详细的报错页面。谢谢大家。

  • 写回答

4条回答 默认 最新

  • CSDN专家-showbo 2021-05-27 21:41
    关注

    替换掉单引号

    string cmdText = "SELECT COUNT(*) FROM [Admin] WHERE UserName='" + userName.Text.Replace("'","") + "' AND userPass='" + passWord.Text.Replace("'","") + "'";

    参数化也可以

     protected void Button1_Click(object sender, EventArgs e)
    {
        string strConnnection = @"Provider=Microsoft.Jet.OLEDB.4.0;Data Source=";
        strConnnection += Server.MapPath("~/App_Data/DataMaster.mdb");
        OleDbConnection conn = new OleDbConnection(strConnnection);
        string cmdText = "SELECT COUNT(*) FROM [Admin] WHERE UserName=? AND userPass=?";
        OleDbCommand cmd = new OleDbCommand(cmdText, conn);
        //framwork2.0
        /*OleDbParameter pUserName = new OleDbParameter("UserName", OleDbType.LongVarWChar,50);
        pUserName.Size = 50;
        pUserName.Direction = ParameterDirection.Input;
        pUserName.Value = userName.Text;

        OleDbParameter puserPass = new OleDbParameter("userPass", OleDbType.LongVarWChar, 50);
        puserPass.Size = 50;
        puserPass.Direction = ParameterDirection.Input;
        puserPass.Value = passWord.Text;

        cmd.Parameters.Add(pUserName);
        cmd.Parameters.Add(puserPass);*/

        //对象初始化器需要framework3+以上，如果是2.0版本用上面注释的代码，下面2句的注释掉，要不会出错
        cmd.Parameters.Add(new OleDbParameter { ParameterName = "UserName", OleDbType = OleDbType.LongVarWChar, Value = userName.Text,Size=50,Direction=ParameterDirection.Input });
        cmd.Parameters.Add(new OleDbParameter { ParameterName = "userPass", OleDbType = OleDbType.LongVarWChar, Value = passWord.Text, Size = 50, Direction = ParameterDirection.Input });

        /////////////////////


        conn.Open();
        int count = (int)cmd.ExecuteScalar();
        conn.Close();
 
        if (/*string.Compare(Session["CheckCode"].ToString(), this.txtCode.Text, true) == 0 &&*/ count > 0)
        {
            Session["myuser"] = userName.Text;
            Response.Write("<script>alert('登录成功!')</script>");
            ClientScript.RegisterStartupScript(this.GetType(), "e", "<script>window.location.href='Main.aspx';</script>");
            return;
        }
        else
        {
            Response.Write("<script>alert('输入错误!')</script>");
            ClientScript.RegisterStartupScript(this.GetType(), "e", "<script>window.location.href='default.aspx';</script>");
        }
    }

    帮助到你可以采纳支持下哦，谢谢~~实测参数化正常运行

     

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(3条)

报告相同问题？

悬赏问题

  • ¥50 用易语言http 访问不了网页
  • ¥50 safari浏览器fetch提交数据后数据丢失问题
  • ¥15 matlab不知道怎么改，求解答！！
  • ¥15 永磁直线电机的电流环pi调不出来
  • ¥15 用stata实现聚类的代码
  • ¥15 请问paddlehub能支持移动端开发吗？在Android studio上该如何部署？
  • ¥20 docker里部署springboot项目，访问不到扬声器
  • ¥15 netty整合springboot之后自动重连失效
  • ¥15 悬赏！微信开发者工具报错，求帮改
  • ¥20 wireshark抓不到vlan