一个简单的后台与数据库交互的登录与注册[sql注入处理、以及MD5加密]

MsSQL 2019-01-03

一、工具：

vs2013[因为我现在用的也是2013，版本随便你自己开心]
sql2008[准备过久升级]

二、用到的语言

HTML+CSS+Jquery+Ajax+sqlserver

HTML[相当于一个人]

css[要穿衣服]

Jquery[人要做一些动作,Jquery是对js一些常用方法的封装]

Ajax[建立前端页面与数据库的交互]
sqlserver[数据库]

三、过程

html部分代码：

rush:xhtml;">

css代码：

rush:css;"> * { margin:0px; padding:0px; } #header { height:40px; width:100%; background:#000000; }

a {
text-decoration:none;
}

header a {

float:right;
color:#ffffff;
line-height:40px;
margin-left:10px;
}

header_con {

width:1200px;
margin:0px auto;
}
.login_Item {
margin-left:20px;
}
.login_Item input {
width:348px;
height:40px;
margin-top:10px;
border:solid 1px #04a6f9;
}
.login_Item a {
margin-top:20px;
width:350px;
height:40px;
display:block;
background:#04a6f9;
color:#ffffff;
line-height:40px;
text-align:center;
}

loginBox {

display:none;///隐藏状态/
margin:0px auto;
}

RegBox {

display:none;
}

js代码：[用了layer插件]

rush:js;"> /// ///

function ShowLoginBox()
{
layer.open({
type: 1,title: "用户登录",//设置div大小
area: ["390px","300px"],content: $("#loginBox")
});
}

function login()
{
//1.获取到用户名和密码
var username = $.trim($("#TxtUserName").val());
var pwd =$.md5( $.trim($("#TxtPwd").val()));
//2.判断用户名和密码是否为空
if (username == "" || pwd == "") {
layer.alert("用户名或密码不能为空！",{
title: "提示:",icon: 5
});
}
else
{
$.post("/Handler1.ashx",{ "UserName": username,"Pwd": pwd,"cmd":"login" },function (data)
{
if (data == "登录成功") {
//layer.alert("登录成功！",layer.msg("登录成功！",{
//title: "提示:",icon: 6
});
}
else
{
layer.msg("用户名或密码不正确",icon: 5
});
}
});
}
}

function showRegBox()
{
layer.open({
type:1,title:"注册",area: ["390px","350px;"],//div的内容
content:$("#RegBox")
});
}

function Reglogin()
{
//1.获取到输入的内容
var username = $.trim($("#TxtRegUserName").val());
var pwd =$.md5($.trim($("#TxtRegPwd").val()));
var qq = $.trim($("#TxtRegqq").val());
var email = $.trim($("#TxtRegEmail").val());
//并做判断
if (username == "" || pwd == "") {
layer.msg("用户名或密码不能为空！");
}
else
{//cmd用做标示，判断是注册还是登录
$.post("/Handler1.ashx","qq":qq,"email":email,"cmd": "reg" },function (data)
{
if (data == "注册成功") {
layer.msg("恭喜你，注册成功！",{
icon: 6
});
}
else
{
layer.msg(data,{
icon:5
});
}
});
}
}

ajax代码：

rush:csharp;"> using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Data; using System.Data.sqlClient;

namespace baidu20160707
{
///

/// Handler1 的摘要说明
///

public class Handler1 : IHttpHandler
{
public HttpContext context;
public string strResult = "";
public void ProcessRequest(HttpContext context)
{
this.context = context;
string cmd=context.Request.Form["cmd"];
switch (cmd)
{
case "login":
strResult = loginAjax();
break;
case "reg":
strResult = RegAjax();
break;
}
context.Response.Write(strResult);
}

//<a href="https://www.jb51.cc/tag/denglu/" target="_blank" class="keywords">登录</a>
public string loginAjax()
{
  //1.接收传过来的<a href="https://www.jb51.cc/tag/yonghuming/" target="_blank" class="keywords">用户名</a>和密码
  string username = context.Request.Form["username"];
  //类名<a href="https://www.jb51.cc/tag/diaoyong/" target="_blank" class="keywords">调用</a><a href="https://www.jb51.cc/tag/fangfa/" target="_blank" class="keywords">方法</a>，32位，再做加盐处理
  string pwd =Md5Class.GetMD5( context.Request.Form["pwd"]+"傻逼玩意",32);
  //所在对应的id是否存在
  //string str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a> = string.Format("select id from Users where UserName='{0}' and Pwd='{1}'",username,pwd);
  //<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>注入处理1.@传参的方式,pwd不要，'分号也不要'
  string str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a> = string.Format("select id from Users where UserName=@UserName and Pwd=@Pwd");
  //<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>注入处理2.<a href="https://www.jb51.cc/tag/diaoyong/" target="_blank" class="keywords">调用</a><a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[]数组对数据进行过滤
  <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[] p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s = new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[] 
  {
    new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter("@UserName",<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>DbType.NVarChar),new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter("@Pwd",<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>DbType.NVarChar)
  };
  //<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>注入处理3.指定它的值
  p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s[0].Value = username;
  p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s[1].Value = pwd;
  //<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>注入处理,4.不能忘记把数组对象传进去
  if (<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>Helper.Exists(str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>,p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s))
  {
    //context.Response.Write("<a href="https://www.jb51.cc/tag/denglu/" target="_blank" class="keywords">登录</a>成功");
    return "<a href="https://www.jb51.cc/tag/denglu/" target="_blank" class="keywords">登录</a>成功";
  }
  else
  {
    //context.Response.Write("<a href="https://www.jb51.cc/tag/yonghuming/" target="_blank" class="keywords">用户名</a>或密码不正确");
    return "<a href="https://www.jb51.cc/tag/yonghuming/" target="_blank" class="keywords">用户名</a>或密码不正确";
  }
}

//<a href="https://www.jb51.cc/tag/zhuce/" target="_blank" class="keywords">注册</a>
public string RegAjax()
{
  //接收传过来的<a href="https://www.jb51.cc/tag/yonghuming/" target="_blank" class="keywords">用户名</a>和密码
  string username=context.Request.Form["username"];
  string pwd=Md5Class.GetMD5(context.Request.Form["pwd"]+"傻逼玩意",32);
  string qq=context.Request.Form["qq"];
  string email = context.Request.Form["email"];
  //string str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>1 = string.Format("select id from Users where UserName='{0}' ",pwd);
  string str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>1 = string.Format("select id from Users where UserName=@UserName ");
  <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[] p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s1 = new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[] 
  {
    new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter("@UserName",<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>DbType.NVarChar)
  };
  p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s1[0].Value = username;
  if (<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>Helper.Exists(str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>1,p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s1))
  //if (<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>Helper.Exists(str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>1))
  {
    return "该<a href="https://www.jb51.cc/tag/yonghu/" target="_blank" class="keywords">用户</a>已<a href="https://www.jb51.cc/tag/zhuce/" target="_blank" class="keywords">注册</a>，请重新输入";
  }
  else
  {
    //不存在就<a href="https://www.jb51.cc/tag/zhuce/" target="_blank" class="keywords">注册</a>
    //string str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>2 = string.Format("insert into Users (UserName,Pwd,QQ,eMail) values('{0}','{1}','{2}','{3}')",pwd,qq,email);
    //,email
    string str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>2 = string.Format("insert into Users (UserName,eMail) values(@UserName,@Pwd,@QQ,@eMail)");
    <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[] p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s2 = new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter[] 
    {
      new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter("@UserName",new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter("@QQ",new <a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>P<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>meter("@eMail",};
    p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s2[0].Value = username;
    p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s2[1].Value = pwd;
    p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s2[2].Value = qq;
    p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s2[3].Value = email;
    //插入处理
    if (<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>Helper.ExecteNonQueryText(str<a href="https://www.jb51.cc/tag/sql/" target="_blank" class="keywords">sql</a>2,p<a href="https://www.jb51.cc/tag/ara/" target="_blank" class="keywords">ara</a>s2) > 0)
    {
      return "<a href="https://www.jb51.cc/tag/zhuce/" target="_blank" class="keywords">注册</a>成功";
    }
    else
    {
      return "<a href="https://www.jb51.cc/tag/zhuce/" target="_blank" class="keywords">注册</a>失败";
    }
  }
}
public bool IsReusable
{
  get
  {
    return false;
  }
}

}
}

效果：点击登录弹出登录框，点击注册，弹出注册框

四、MD5加密算法

MD5加密算法：大多数情况下，用户的密码是存储在数据库中的，如果不采取任何的保密措施，以明文的方式保存密码，查找数据库的人员就可以轻松获取用户的信息，所以为了增加安全性，对数据进行加密是必要的。MD5,是一种用于产生数字签名的单项散列算法，它以512位分组来处理输入的信息，且每一分组又被划分为16位子分组，经过一系列处理，算法的输入由4个32位分组级联后生成一个128位散列值。

没有加密之前的明文通过解析的效果：