do/login.ashx

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<%@ WebHandler Language="C#" Class="login" %>

using System;
using System.Data;
using System.Data.SqlClient;
using System.Web;
using System.Web.SessionState;
using System.Web.Security;
using System.Text;
using DbPrvd;

public class login : IHttpHandler, IRequiresSessionState{
    
    private HttpContext crtContext;
    
    public void ProcessRequest (HttpContext context) {
        
        crtContext = context;
        
        if (crtContext.Request.UrlReferrer != null){//判断是否有来路

            string username = string.Empty, password = string.Empty, checkcode = string.Empty;

            if (!string.IsNullOrEmpty(crtContext.Request.Form["tbxusername"].ToString()))
                username = crtContext.Request.Form["tbxusername"].ToString();
            else
                crtContext.Response.Write("<script type='text/javascript'>alert('请填写用户名');history.go(-1);</script>");
            

            if (!string.IsNullOrEmpty(crtContext.Request.Form["tbxpassword"].ToString()))
                password = crtContext.Request.Form["tbxpassword"].ToString();
            else
                crtContext.Response.Write("<script type='text/javascript'>alert('请填写密码');history.go(-1);</script>");

            
            if (!string.IsNullOrEmpty(crtContext.Request.Form["tbxcheckcode"].ToString()))
                checkcode = crtContext.Request.Form["tbxcheckcode"].ToString();
            else
                crtContext.Response.Write("<script type='text/javascript'>alert('请填写验证码');history.go(-1);</script>");

            if (crtContext.Session["valicode"] != null)
            {
                if (!string.IsNullOrEmpty(crtContext.Session["valicode"].ToString()) && (crtContext.Session["valicode"].ToString().ToLower() == checkcode.ToLower()))
                {
                    password = FormsAuthentication.HashPasswordForStoringInConfigFile(password, "MD5");
                    string loginQuery = "select id from ["+SqlHelper.Tbpre+"admin] where [isopen]='yes' and [username]='" + username + "' and [password]='" + password + "'";
                    //crtContext.Response.Write(loginQuery);
                    //crtContext.Response.End();
                    object result = DbPrvd.SqlHelper.ExecuteScalar(DbPrvd.SqlHelper.ConStr, CommandType.Text, loginQuery);
                    if (result != null)
                    {
                        string Role = DbPrvd.SqlHelper.ExecuteScalar(DbPrvd.SqlHelper.ConStr, CommandType.Text, "select role from [" + SqlHelper.Tbpre + "admin] where username='"+username+"'").ToString();
                        crtContext.Session["User"] = username;
                        crtContext.Session["Role"] = Role;
                        //crtContext.Response.Write("<script type='text/javascript'>alert('" + crtContext.Session["User"] + "');history.go(-1)</script>");
                        crtContext.Response.Write("<script type='text/javascript'>document.location='../index.aspx';</script>");
                    }
                    else
                    {
                        crtContext.Response.Write("<script type='text/javascript'>alert('用户名或密码错误,登录失败！');history.go(-1);</script>");