WooYun.org

<%
2
Response.Redirect("cms_login.asp")
3
%>

<!--#include file="../_system/conn.asp"-->
02
<!--#include file="../_system/library.asp"-->
03
<%
04
If rf("submit") = "管理登录" Then
05
    Call null_back(rf("login_name"), "用户名不能为空！")
06
    Call null_back(rf("login_password"), "密码不能为空！")
07
    Call null_back(rf("login_verifycode"), "验证码不能为空！")
08
    If CStr(Session("CheckCode")) <> CStr(Request.Form("login_verifycode")) Then
09
        Call alert_href("验证码错误！","cms_login.asp")
10
    End If
11
    Set rs = ado_query("select * from cms_admin where a_enable = 1 and a_name='"&str_safe(request.Form("login_name"))&"' and a_password='"&md5(str_safe(request.Form("login_password")))&"'")
12
        response.write "select * from cms_admin where a_enable = 1 and a_name='"&str_safe(request.Form("login_name"))&"' and a_password='"&md5(str_safe(request.Form("login_password")))&"'"
13
    If Not rs.EOF Then
14
            Response.Cookies("admin_check") = request.Form("login_name")
15
        rs.close
16
                set rs = nothing
17
        response.redirect "cms_welcome.asp"
18
    Else
19
        rs.close
20
                set rs = nothing
21
        Call alert_href("错误提示：用户名或密码错误，请核对后重新输入！","cms_login.asp")
22
    End If
23
End If
24
%>

Function str_safe(byval Str)
02
    If IsNull(Str) Then Exit Function
03
    Str = str_isafe(Str)
04
    Str = Replace(Str, "<", "<")
05
    Str = Replace(Str, ">", ">")
06
    Str = Replace(Str, """", """)
07
    str_safe = Str
08
End Function
09
Function str_editor(str)
10
    If IsNull(Str) Then Exit Function
11
        str = Replace(str, "&", "&")
12
        str = Replace(str, "<", "<")
13
        str = Replace(str, ">", ">")
14
        str = Replace(str, """", """)
15
        str_editor = str
16
End Function
17
 
18
'函数：SQL关键词过滤 用于获取含HTML标签的内容
19
 
20
Function str_isafe(byval Str)
21
    If IsNull(Str) Then Exit Function
22
    Str = Replace(Str, "select ", "select ", 1, -1, 1)
23
    Str = Replace(Str, "insert ", "insert ", 1, -1, 1)
24
    Str = Replace(Str, "update ", "update ", 1, -1, 1)
25
    Str = Replace(Str, "delete ", "delete ", 1, -1, 1)
26
    Str = Replace(Str, " and", " and ", 1, -1, 1)
27
    Str = Replace(Str, "drop table", "drop table", 1, -1, 1)
28
    Str = Replace(Str, "script", "script")
29
    Str = Replace(Str, "*", "*")
30
    Str = Replace(Str, "%", "%")
31
    Str = Replace(Str, "'", "''")
32
    str_isafe = Str
33
End Function

<%
02
'==========获取当前账户相关信息==========
03
'response.write Request.Cookies("admin_check")
04
If inull(Request.Cookies("admin_check")) Then
05
    Response.Redirect("index.asp")
06
End If
07
Set rs_gap = ado_query("select * from cms_admin where a_name = '"&Request.Cookies("admin_check")&"'")
08
If rs_gap.EOF Then
09
    Response.Redirect("index.asp")
10
End If
11
admin_name = rs_gap("a_name")
12
'response.write admin_name
13
admin_truename = rs_gap("a_truename")
14
admin_penname = rs_gap("a_penname")
15
admin_purview = rs_gap("a_purview")
16
arr_admin_purview = Split(admin_purview, ",")
17
rs_gap.Close
18
Set rs_gap = Nothing