网站登录问题 [英] Problem with website login

问题描述

我正在尝试使用ms访问数据库为网站创建登录表单。我正在使用visual studio 2010 c＃并访问2013.由于某种原因我无法登录。我真的很新，所以任何帮助都表示赞赏。



DataLayer：

Im trying to create a login form for a website using ms access database. I'm using visual studio 2010 c# and access 2013. For some reason I can't get it to log in. I'm really new to this so any help is appreciated.

DataLayer:

public class DataConnector
    {
        protected OleDbDataAdapter DataAdapter1 = new OleDbDataAdapter();
        public string ErrorMessage = "";
        public DataConnector(string ConnectionString)
        {
            OleDbConnection Connection1 = new OleDbConnection(ConnectionString);
            this.DataAdapter1.SelectCommand = new OleDbCommand("", Connection1);
            this.DataAdapter1.InsertCommand = new OleDbCommand("", Connection1);
        }
        public DataTable DataSelect(string query)
        {
            DataTable dt = new DataTable();
            try
            {
                DataAdapter1.SelectCommand.CommandText = query;
                DataAdapter1.SelectCommand.Connection.Open();
                DataAdapter1.Fill(dt);
                DataAdapter1.SelectCommand.Connection.Close();
                ErrorMessage = "";
            }
            catch(Exception err)
            {
                ErrorMessage = err.Message;
                DataAdapter1.SelectCommand.Connection.Close();
            }
            return dt;
        }
        public int DataInsert(string query)
        {
            int Result = 0;
            try
            {
                DataAdapter1.InsertCommand.CommandText = query;
                DataAdapter1.InsertCommand.Connection.Open();
                Result = DataAdapter1.InsertCommand.ExecuteNonQuery();
                DataAdapter1.InsertCommand.Connection.Close();
                ErrorMessage = "";
                return Result;
            }
            catch (Exception err)
            {
                ErrorMessage = err.Message;
                DataAdapter1.InsertCommand.Connection.Close();
                return 0;
            }
            
        }
        public int DataUpdate(string query)
        {
            return DataInsert(query);
        }
        public int DataDelete(string query)
        {
            return DataInsert(query);
        }
    }

Default.aspx.cs：

Default.aspx.cs:

public partial class Default : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {

        }

        protected void btnLogin_Click(object sender, EventArgs e)
        {

            DataLayer.DataConnector dat = new DataLayer.DataConnector("Provider=Microsoft.ACE.OLEDB.12.O;"+"Data Source='"+Server.MapPath("site_database.accdb")+"'; Persist Security Info=False;");
            DataTable dt = dat.DataSelect("select UserID from tbl_login where Username = '" + txtUsername.Text + "' and Password = '"+ txtPassword.Text +"' ");
            if (dt.Rows.Count > 0)
            {
                Response.Redirect("members_area.aspx");
            }
            else
                lblerror.Text = "Login failed";
            
        }
    }

我是没有任何错误，我只是c不知道了。当我尝试登录时，只停留在default.aspx页面上。

I'm not getting any errors and I just can't figure it out. When I try to log in it just stays on the default.aspx page.

推荐答案

有很多方法可能会对你造成错误。要做的第一件事就是停止这样做！



首先要做的是通过连接字符串来构建SQL命令。这不会引起您所讨论的问题，但它确实让您对SQL注入攻击持开放态度，这可能会破坏或破坏您的数据库。鉴于这是一个网站，这意味着我可以转到您的默认页面，输入用户名或密码框并删除您的Access数据。或者在不知道密码的情况下以任何用户身份登录...

始终使用参数化查询！



第二个是从不存储明文密码 - 这是一个主要的安全风险。有关如何在此处执行此操作的信息：密码存储：如何做到这一点。 [ ^ ]



之后你需要开始查看正在发生的事情 - 所以要么在调试器中运行它，看看发生了什么（它是可能是一个例外，但除非你发现它在哪里，你甚至可以开始修复它。所以尝试... catch 块和日志记录是当天的顺序，结合使用调试器来跟踪实际发生的情况。



但是......你为什么酝酿自己的？

为什么不让系统处理它：会员资格介绍 [ ^ ]

There are so many, many ways this could go wrong on you. The first thing to do is to stop doing it like that!

The first thing to not do is build SQL commands by concatenating strings. This isn't causing teh problem you are talking about, but it does leave you wide open to an SQL Injection attack, which can damage or destroy your database. And given that this is a website, that means I could go to your default page, type in the username or password box and delete your Access data. Or log in as any user without knowing their password...
Use parameterized queries at all times!

The second is "Never store passwords in clear text" - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]

After that you need to start looking at what is happening - so either run this in the debugger and see what occurs (it's probably an exception, but unless you find out where it is you can;t even start to fix it). So try...catch blocks and logging are the order of the day, combined with using the debugger to follow what is actually happening.

But...why are you "brewing your own"?
Why not let the system handle it: Introduction to Membership[^]

这篇关于网站登录问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！