未防注入//0.0
/**
*這里代碼應用場景為多類用戶登錄，根據用戶選擇不同的單選按鈕判斷用戶登錄的類型，
*從而進行不同的數據表進行判斷，用戶的用戶名和密碼是否正確。
*/
1 public partial class _Default : System.Web.UI.Page 2 { 3 public string USER = "", PASSWORD = "";//過濾用戶的輸入 4 public int TYPE = -1;//驗證用戶選擇的類型，初始值-1 5 protected void Page_Load(object sender, EventArgs e) 6 { 7 if (!IsPostBack) 8 { 9 username.Text = ""; 10 password.Text = ""; 11 } 12 } 13 protected void Button1_Click(object sender, EventArgs e)//判斷用戶選擇的身份，進行相應的調用函數 14 { 15 switch (xz.SelectedValue) 16 { 17 case "1": login(1); break; 18 case "2": login(2); break; 19 case "3": login(3); break; 20 } 21 } 22 protected void Button2_Click(object sender, EventArgs e) //根據用戶選擇的身份，跳轉到相應的注冊頁面 23 { 24 switch (xz.SelectedValue) 25 { 26 case "1":Server.Transfer("zhuce.aspx"); break; 27 case "2": Server.Transfer("teachaerzhuce.aspx"); break; 28 case "3": Response.Write("<script>alert('管理員注冊未開放！');</script>"); break; 29 } 30 31 } 32 protected void login(int TYPE)//傳人用戶選擇的類型，執行不同的操作 33 { 34 string Type = ""; 35 switch (TYPE) 36 { 37 case 1: Type = "同學"; break; 38 case 2: Type = "老師"; break; 39 case 3: Type = "adminsitrator"; break; 40 } 41 USER = username.Text; 42 PASSWORD = password.Text; 43 if (yz(TYPE, USER, PASSWORD))//調用yz()函數進行判斷 44 { 45 if (Type != "adminsitrator") 46 Response.Write("<script>alert('歡迎 " + Type + " 回家!');</script>"); 47 Session["id"] = USER.ToString() ; 48 Session["bz"] = "yes";//標志 49 switch (TYPE) 50 { 51 case 1: Server.Transfer("students.aspx"); break; 52 case 2: Server.Transfer("teacher.aspx"); break; 53 case 3: Response.Write("<script>alert('Sorry,administrator 回家了！');</script>"); break; 54 } 55 } 56 else 57 { 58 Response.Write("<script>alert('sorry,username or password error!');</script>"); 59 60 } 61 62 } 63 protected bool yz(int TYPE, string USER, string PASSWORD)//根據選則的用戶身份，進行驗證數據庫，成功TRUE，失敗FALSE 64 { 65 string Type = ""; 66 switch (TYPE) 67 { 68 case 1: Type = "stu_"; break; 69 case 2: Type = "tea_"; break; 70 case 3: Type = "admin_"; break; 71 } 72 string sqlstr = "select * from " + Type + " where " + Type + "user='" + USER + "' and " + Type + "pass='" + DB.MD5Encrypt(PASSWORD) + "';"; 73 DB db = new DB();//DB類用來對數據庫的操作 74 75 MySqlDataReader selectcom = db.Select1(sqlstr); 76 while (selectcom.Read()) 77 { 78 return true; 79 } 80 return false; 81 } 82 }