请求帮忙修复or漏洞!!急!!
login.asp代码如下:<%@ Language=VBScript %>+ S E' ~7 u- i8 n! X f' m
<!--#include file="..\inc\conn.asp"-->
& L1 ]1 b7 @( W2 N# d<%$ j$ m6 O0 F. w* r; t
if request.Form("submit")<>"" then ~' F' [3 o( r; @- J& q3 ]
if request.Form("userid")="" or request.Form("password")="" then7 P' b) l0 C: R2 ~7 ?
response.Write("<script language=javascript>alert('用户名或者密码不能为空!');history.back();</script>")
& [% \3 {- r+ S8 l; U$ f2 A1 g response.end
& e1 O! A7 m9 A! B2 E" J u2 O end if
( O& G0 R3 @: a+ w+ ]; g! G set rs=conn.execute("select * from gly where uid='"&trim(request.form("userid"))&"' and pwd='"&trim(request.form("password"))&"'")1 W5 N( M. [: s* R# X1 X
if rs.eof then L) y- K3 i) Z$ T, l6 G( x
response.Write("<script language=javascript>alert('用户名或者密码验证失败!');history.back();</script>")
$ I+ d% ~. m" Z ~ response.End()
! n+ d% V S$ t: M/ [* L% q6 p else( V' P, i* g* b4 H: w, s
if rs("IsSuper")=1 then0 a' b* R, v4 Z6 X8 S
session(strSession&"uid")="s"5 m- s' W1 s2 K' ]; E9 [* [
session(strSession&"uidn")=rs("id")
! S: I5 u4 ^! U( [% q0 O session(strSession&"user")=rs("uid")( ~1 {7 x4 r1 N* Q' d
else5 P9 p( N# Q) @8 d# \5 F
session(strSession&"uid")="n"6 m* T2 @( L. Q5 f
session(strSession&"uidn")=rs("id"), d. ]7 ?3 j# c" ]8 D; d
session(strSession&"user")=rs("uid")
3 f5 i" w% m p: b end if0 @! M8 v: n' {! F4 v
response.Redirect("index.asp")
) L3 j" T* f6 X1 s; W* z6 O* q" n! m response.End()
8 i! ^) n. C: Y9 ]9 g# K end if
. C* q5 S) }: u4 |* g rs.close; B' k! {! E- N! v- T" K
set rs=nothing3 p: j+ x! g, f& r
* V7 E2 G% n( \: H( T, i
end if3 a6 N& o& C! @
%>, z; z+ v2 K8 L) }. G2 r+ Y3 f/ D
<meta http-equiv="Content-Type" c>
) w' o( c/ H5 x# p1 D* G8 H% ?<style type="text/css">' q* d# w, A+ `) j- b
<!--: R! Y1 c% z; J) t) z
body{font-size: 12px;}
( P% K, ^ D- c; Z, Ktd{font-size: 12px;}
% |: f+ V% N5 ^- S1 G W; h6 Yinput{font-size: 12px;}
/ r y; S4 B0 w# Q7 ~1 lselect{font-size: 12px;}
9 S) O1 x% k8 \% z( \5 y.style6 {color: #993300; font-weight: bold; font-size: 12px; }8 H7 |% f7 {& |0 C
.style7 {color: #666666}2 b; P) c: V q5 f+ Q; r; @6 m
.style9 {color: #FF0000}+ H& x' j n& ?2 m+ k/ [
.STYLE11 {/ B5 Z5 a( ^" ], p. a9 n0 m9 f
font-size: 14px;
& H8 h3 ^+ A" d font-weight: bold;
( s/ r8 D7 n w}
( o+ ^/ J. |* P5 [/ j; o-->
2 b/ y3 f0 v5 T) V# ?</style>
% {1 F8 a4 z' @, U; \<p> </p>
3 Z2 C! T3 k+ P$ p5 @1 ^' [/ ]<table width="400" height="300" border="0" align="center" cellpadding="0" cellspacing="0" background="images/login.gif">
/ }! T% v1 l' G1 s- k <tr>
# p+ E- `; ^2 D; |3 B' p9 C <td align="center" valign="middle"><table width="200" border="0" cellspacing="0" cellpadding="0">, D& x) W7 p2 F4 ^
<form action="login.asp" name="login" id="login" method="post">
3 x0 o% j1 R/ T, O6 i! Y% F <tr>3 b" u8 ]7 ?, Y+ y) T
<td width="60" height="30" align="center"><span class="STYLE11">用户名</span></td>
0 k) C/ |, R6 H" {3 i6 y7 j0 h' C <td align="center"><input name="userid" type="text" id="userid" style="width:120px;"/></td>
# i1 a8 ], G# I </tr>
4 C0 F0 _9 t$ C2 H7 J( W: Z <tr> N0 H6 X: ~9 q, O. ~. M0 s4 E3 h6 F
<td width="60" height="30" align="center"><span class="STYLE11">密 码</span></td>* T9 g9 h, t3 i5 b, Y0 ^/ u
<td align="center"><input name="password" type="password" id="password" style="width:120px;" /></td>
5 ^+ }: [ T' u& k </tr>- [( G9 f- y+ H: b* g4 v+ f
<tr>
. n P R8 G) l' d* X <td height="30" colspan="2" align="center"><label>2 j: D0 V8 j3 p) ~( o# U
<input type="submit" name="Submit" value=" 提 交 " />
( v% n. S% R# b; L: W </label></td>
0 }# ^0 r. @+ k& b7 I& x) G </tr>) ?- K2 L. i/ w3 x1 d5 |
</form>6 t( A: j6 z$ l7 t
</table></td>) S9 l" ~8 z0 L
</tr>- P- T% O& T7 X# ]6 t6 T1 U! E3 m
</table>2 P G9 W V+ ^
2 E% L) ]1 q2 {4 |6 z1 Y$ Q
! P, O. f- p. U. J% i& t
% e( t6 R3 }5 o a# p9 M! H
2 J% M( m1 @; M小弟先谢过了!