Hej
Lad det være sagt jeg er ikke nogen ørn til asp
Følgende login script fungere fint, men har en bug som gør det muligt at skrive 'or '1'='1 i henholdsvis brugernavn og password. Herefter kan man frit logge ind.
Det er jo ikke smart
Kan nogen derfor hjælpe mig med at lukke dette hul på følgende script?
<%@LANGUAGE="VBSCRIPT"%>
<!--#include file="../Connections/Login.asp" -->
<%
'Recordset1.Connection = "DRIVER={Microsoft Access Driver (*.mdb)};DBQ=" & Server.MapPath("d:\\database\\login.asp") & "\\login.mdb
Session("dbConn") = "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=d:\\ \\database\\login2.mdb"
'Session("dbConn") = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=d:\\ \\database\\Login.mdb"
Set conn = Server.CreateObject("ADODB.Connection")
set Recordset1 = Server.CreateObject("ADODB.Recordset")
conn.Open Session("dbConn")
Recordset1.Source = "SELECT * FROM tblLogin"
Recordset1.CursorType = 0
Recordset1.CursorLocation = 2
Recordset1.LockType = 3
'Recordset1.Open()
Recordset1_numRows = 0
%>
<%
' *** Validate request to log in to this site.
MM_LoginAction = Request.ServerVariables("URL")
If Request.QueryString<>"" Then MM_LoginAction = MM_LoginAction + "?" + Request.QueryString
MM_valUsername=CStr(Request.Form("UserID"))
If MM_valUsername <> "" Then
MM_fldUserAuthorization=""
MM_redirectLoginSuccess="nord.asp"
MM_redirectLoginFailed="/ fail-login.asp"
MM_flag="ADODB.Recordset"
set MM_rsUser = Server.CreateObject(MM_flag)
'MM_rsUser.ActiveConnection = "DRIVER={Microsoft Access Driver (*.mdb)};DBQ=" & Server.MapPath("d:\\web \\database\\login.asp") & "\\login.mdb"
MM_rsUser.ActiveConnection = "DRIVER={Microsoft Access Driver (*.mdb)};DBQ=d:\\ database\\login2.mdb"
MM_rsUser.Source = "SELECT UserID, Password"
If MM_fldUserAuthorization <> "" Then MM_rsUser.Source = MM_rsUser.Source & "," & MM_fldUserAuthorization
MM_rsUser.Source = MM_rsUser.Source & " FROM tblLogin WHERE UserID='" & MM_valUsername &"' AND Password='" & CStr(Request.Form("Password")) & "'"
MM_rsUser.CursorType = 0
MM_rsUser.CursorLocation = 2
MM_rsUser.LockType = 3
MM_rsUser.Open
If Not MM_rsUser.EOF Or Not MM_rsUser.BOF Then
' username and password match - this is a valid user
Session("MM_Username") = MM_valUsername
If (MM_fldUserAuthorization <> "") Then
Session("MM_UserAuthorization") = CStr(MM_rsUser.Fields.Item(MM_fldUserAuthorization).Value)
Else
Session("MM_UserAuthorization") = ""
End If
if CStr(Request.QueryString("accessdenied")) <> "" And false Then
MM_redirectLoginSuccess = Request.QueryString("accessdenied")
End If
MM_rsUser.Close
Response.Redirect(MM_redirectLoginSuccess)
End If
MM_rsUser.Close
Response.Redirect(MM_redirectLoginFailed)
End If
%>
<html>
<head>
<title>LOGIN</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link rel="stylesheet" href="general/styles.css" type="text/css">
<script language="JavaScript">
<!--
function MM_callJS(jsStr) { //v2.0
return eval(jsStr)
}
function placeFocus() {
if (document.forms.length > 0) {
var field = document.forms[0];
for (i = 0; i < field.length; i++) {
if ((field.elements[i].type == "text") || (field.elements[i].type == "textarea") || (field.elements[i].type.toString().charAt(0) == "s")) {
document.forms[0].elements[i].focus();
break;
}
}
}
}
//-->
</script>
</head>
<body bgcolor="#DBDBDB" text="#000000" OnLoad="placeFocus()">
<p> </p>
<form name="FrmLogin" method="post" action="<%=MM_LoginAction%>">
<table width="25%" border="0" align="center" class="broed">
<tr>
<td width="60%">
<input type="text" name="UserID" class="inputtext" object.focus() onBlur="MM_callJS('focus')">
</td>
<td width="40%" align="left">Brugernavn</td>
</tr>
<tr>
<td width="60%">
<input type="password" name="Password" class="inputtext">
</td>
<td width="40%" align="left">Adgangskode</td>
</tr>
<tr>
<td width="60%">
<input type="submit" name="Login" value="Videre" class="inputknap">
</td>
<td width="40%"> </td>
</tr>
</table>
</form>
<table width="50%" border="0" align="center" cellpadding="0" cellspacing="0" class="broed">
<tr>
<td> <script type="text/javascript">
//<!-- Begin
var todaydate = new Date();
var timeis = todaydate.getTime();
todaydate.setTime(timeis);
var houris = todaydate.getHours();
if (houris > 17) display = "aften";
else if (houris >12) display = "eftermiddag";
else display = "morgen";
var welcome = ("God " + display + ". Velkommen til");
document.write(welcome);
// End -->
</script></td>
</tr>
</table>
</body>
</html>
<%
'Recordset1.Close()
conn.close
set conn = nothing
%>
Indlæg senest redigeret d. 21.03.2006 15:59 af Bruger #8176