chklogin.asp

这个就是受到众人喜爱的许愿墙了

<!--#include file="conn.asp"-->
<!--#include file="md5.asp"-->
<%
'用于防止sql注入
Dim Love_NoSqlHack_AllStr,Love_NoSqlHack_Str,Love_NoSqlHack_ComeUrlGet,Love_NoSqlHack_ComeUrlPost,Love_NoSqlHack_Get,Love_NoSqlHack_Post,Love_NoSqlHack_i

Love_NoSqlHack_AllStr="'|;| and |chr(|exec |insert |select |delete from|update |mid(|master."
Love_NoSqlHack_ComeUrlPost  = Request.Form
Love_NoSqlHack_Str = Split(Love_NoSqlHack_AllStr,"|")
'Post
If Love_NoSqlHack_ComeUrlPost<>"" then
	For Each Love_NoSqlHack_Post In Request.Form
		For Love_NoSqlHack_i = 0 To Ubound(Love_NoSqlHack_Str)
			If Instr(LCase(Request.Form(Love_NoSqlHack_Post)),Love_NoSqlHack_Str(Love_NoSqlHack_i))<>0 Then
				Response.Write("请误使用非法途径进入本网站!")
				Response.End
			End if
		Next
	Next
End if
%>
<%
AdminName=trim(Request.form("AdminName"))
password=trim(Request.form("password"))

if AdminName="" or password="" then 
	Response.Redirect ("adminlogin.asp")
end if

password=md5(trim(password),16)

set rs=server.createobject("adodb.recordset")
sql="select * from admin where AdminName='"&AdminName&"'and password='"&password&"'"
set rs=conn.Execute(sql)
if not rs.eof and not rs.bof then
	conn.Execute("update admin set Logincount=Logincount+1,LoginTime='"&now()&"',LoginIP='" & Request.ServerVariables("REMOTE_ADDR") & "' where AdminName='"&AdminName&"'and password='"&password&"'")
	Session("Admin")=rs("AdminName")
	Session("IsAdmin")=true
    Session.timeout=900
	Response.Redirect ("adminindex.asp")
else
	Response.Write "请输入正确的管理员名字和密码！<a href='javascript:history.back(-1)'>返回</a>"
	Response.End 
end if
rs.close
set rs=nothing
CloseConn()
%>