When design Asp website,always need involve encrypted data which is stored in the database, such as registered users, user name and password storage. If just use codes stored in the database directly, once the database is trespassed by malicious program of hacked, it can be directly seen the user's user name and password, cause to leakage of sensetive information.
To solve the above problem, the solution is stored in the database after the data encryption, common idea is the user name codes stored, then encrypted password storage. Certainly, encryption algorithms have certain requirements that should be a one-way encrypted information, irreversible, can not be restored by other algorithms.
Among the algorithms, md5 algorithm is the most famous and commonly used encryption algorithm. md5 encryption algorithm is based on a variable-length binary value, the method is mapping into a fixed length hash value. If there are any changes to the encrypted file, the map will change the hash value. This feature is not only the key used to encrypt database data, also used to verify the download data whether the packet is identical with the published data packets, mainly used in CD image verification system.
md5 algorithm implementation (md5.asp) has become a common subroutine contains the md5 algorithm function. For the encrypted data, you can call the file contains and md5 () function to implement data transfer before the encrypted and storage. Specific form as follows:
1. Register user encryption \'includes md5 file
... ...
password=md5(ltrim(request.form("password"))) \'use md5 encryption (sql server)
password=md5(trim(request.form("password"))) \'use md5 encryption (Access)
... ...
2. Process user login \'inc md5 file
... ...
dim rs
UserName1=request.form("UserName")
password=md5(trim(request.form("password"))) \'through md5 encryption to get pw(Access)
verifycode=request.form("verifycode")
set rs=server.createobject("adodb.recordset")
sql="select * from admin where username=\'"&username1&"\'"
rs.open sql,conn,1,3 \'Generated record set
if password<>rs("password") or verifycode<>session("verifycode") then
response.write "
The runat = server line tells us that it was executed on the server. So it can not use msgbox () function, can not use the document.Write method.
Full method is:
<---!SCRIPT LANGUAGE="VBScript" RUNAT="Server"---!>
Sub Application_OnStart
... ...
End sub
Sub Application_Onend
... ...
End Sub
Sub session_OnStart
... ...
End Sub
Sub session_Onend
... ...
End SubWhen you visit a website. If it is html based, then the program will not run because there is no application, session objects occur.
If it is ASP based, the server firstly checks the root www directory or virtual directory to see whether there is a global.asa file. If so, then run the program to the corresponding code
How to remind the user once a failure to object in the session?First of all, I will discuss how to reminder after failure. Does it need remind? Why do not use direct detection value of session ("**").
** means you want to test whether the failure of its session ("**") value. This is not good, because the people who come firstly may be null of its session ("**").
So, we will look at where will be applied for. The most obvious example is the login page, if you use session to store the user's login status. You have to tell him whether the failure of login.
Now This is a sample for my assignment:
<---!SCRIPT LANGUAGE="VBScript" RUNAT="Server"---!>
Sub Application_OnStart
Application.Lock
Application("site_name") = "Welcome to Australia Wine Distributors Network--AWDN official website"
Application("user_online") = 0
Application("template") = "template"
Application("conn") = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source="&Server.MapPath("data.mdb")&";"
Application.UnLock
End Sub
Sub Session_OnStart
Session.Timeout=20
Session("userid") = "0"
Session("username") = "0"
Session("level") = "0"
Set conn = Server.CreateObject("ADODB.Connection")
conn.Open Application("conn")
set objRs = Server.CreateObject("ADODB.RecordSet")
szSql = "select top 1 * from [count]"
objRs.open szsql,conn,1,3
if not objRs.eof then
objRs("count") = objRs("count")+1
else
objRs.addnew
objRs("count") = 1
end if
objRs.update
objRs.close
set objRs = nothing
set conn = nothing
End Sub
Sub Session_OnEnd
Session("userid") = "0"
Session("username") = "0"
Session("level") = "0"
End Sub
Sub Application_OnEnd
Application.Lock
Application("user_online") = 0
Application.UnLock
End Sub
<---!/SCRIPT---!> When user login to database, s welcome will be appeared. A record will be in database such as yser's operation and session. If user doesn't use it more than 20 minutes (Session.Timeout=20), system will lock and require user login again.
Note:
---! need be removed.
