一个简单的后台与数据库交互的登录与注册[sql注入处理、以及MD5加密]（登陆页面sql注入）墙裂推荐

namespace baidu20160707
{
/// <summary>
/// Handler1 的摘要说明
/// </summary>
public class Handler1 : IHttpHandler
{
public HttpContext context;
public string strResult=””;
public void ProcessRequest(HttpContext context)
{
this.context=context;
string cmd=context.Request.Form[“cmd”];
switch (cmd)
{
case “login”:
strResult=loginAjax();
break;
case “reg”:
strResult=RegAjax();
break;
}
context.Response.Write(strResult);
}

//登录
public string loginAjax()
{
//1.接收传过来的用户名和密码
string username=context.Request.Form[“username”];
//类名调用方法，32位，再做加盐处理
string pwd=Md5Class.GetMD5( context.Request.Form[“pwd”]+”傻逼玩意”,32);
//所在对应的id是否存在
//string strsql=string.Format(“select id from Users where UserName='{0}’ and Pwd='{1}'”, username, pwd);
//sql注入处理1.@传参的方式,, username, pwd不要，’分号也不要’
string strsql=string.Format(“select id from Users where UserName=@UserName and Pwd=@Pwd”);
//sql注入处理2.调用SqlParameter[]数组对数据进行过滤
SqlParameter[] paras=new SqlParameter[]
{
new SqlParameter(“@UserName”,SqlDbType.NVarChar),
new SqlParameter(“@Pwd”,SqlDbType.NVarChar)
};
//sql注入处理3.指定它的值
paras[0].Value=username;
paras[1].Value=pwd;
//sql注入处理,4.不能忘记把数组对象传进去
if (SqlHelper.Exists(strsql,paras))
{
//context.Response.Write(“登录成功”);
return “登录成功”;
}
else
{
//context.Response.Write(“用户名或密码不正确”);
return “用户名或密码不正确”;
}
}

//注册
public string RegAjax()
{
//接收传过来的用户名和密码
string username=context.Request.Form[“username”];
string pwd=Md5Class.GetMD5(context.Request.Form[“pwd”]+”傻逼玩意”,32);
string qq=context.Request.Form[“qq”];
string email=context.Request.Form[“email”];
//string strsql1=string.Format(“select id from Users where UserName='{0}’ “,username,pwd);
string strsql1=string.Format(“select id from Users where UserName=@UserName “);
SqlParameter[] paras1=new SqlParameter[]
{
new SqlParameter(“@UserName”,SqlDbType.NVarChar)
};
paras1[0].Value=username;
if (SqlHelper.Exists(strsql1, paras1))
//if (SqlHelper.Exists(strsql1))
{
return “该用户已注册，请重新输入”;
}
else
{
//不存在就注册
//string strsql2=string.Format(“insert into Users (UserName,Pwd,QQ,eMail) values(‘{0}’,'{1}’,'{2}’,'{3}’)”, username, pwd, qq, email);
//, username, pwd, qq, email
string strsql2=string.Format(“insert into Users (UserName,Pwd,QQ,eMail) values(@UserName,@Pwd,@QQ,@eMail)”);
SqlParameter[] paras2=new SqlParameter[]
{
new SqlParameter(“@UserName”,SqlDbType.NVarChar),
new SqlParameter(“@Pwd”,SqlDbType.NVarChar),
new SqlParameter(“@QQ”,SqlDbType.NVarChar),
new SqlParameter(“@eMail”,SqlDbType.NVarChar),
};
paras2[0].Value=username;
paras2[1].Value=pwd;
paras2[2].Value=qq;
paras2[3].Value=email;
//插入处理
if (SqlHelper.ExecteNonQueryText(strsql2, paras2) > 0)
{
return “注册成功”;
}
else
{
return “注册失败”;
}
}
}
public bool IsReusable
{
get
{
return false;
}
}
}
}