2019/0517/ASP.NET Webform介紹Master page 主頁 & Session 簡介 & 登入login驗證 & 隱碼攻擊injection & 工具箱程式碼片段使用

登入有幾千幾百種做法各自有內容

首先/ASPnet/Site1.Master ( 用於等等登入驗證介紹

Master page主頁面 ( 主板頁面

語意標籤 17CSS_Position 排版

引入 Nugget bs4 所有內容頁面都會吃到libray庫效果排版

###/ASPnet/Site1.Master

<%@ Master Language="C#" AutoEventWireup="true" CodeBehind="Site1.master.cs" Inherits="ASPnet.Site1" %>

<!DOCTYPE html>

<html>
<head runat="server">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
    <title></title>
    <link href="Content/bootstrap.min.css" rel="stylesheet" />
    <asp:ContentPlaceHolder ID="head" runat="server">
    </asp:ContentPlaceHolder>
</head>
<body>
    <form id="form1" runat="server">
        <div class="container">
            <div class="row">
                <header class="col-md-12">
                    header
                </header>
            </div>
            <div class="row">
                <aside class="col-md-3">
                    aside
                </aside>
                <article class="col-md-9">
                    <asp:ContentPlaceHolder ID="ContentPlaceHolder1" runat="server">
                    </asp:ContentPlaceHolder>
                </article>
            </div>
            <div class="row">
                <footer class="col-md-12">
                    footer
                </footer>
            </div>

        </div>
    </form>
</body>
</html>

###/ASPnet/41MainPage.aspx

<%@ Page Title="" Language="C#" MasterPageFile="~/Site1.Master" AutoEventWireup="true" CodeBehind="41MainPage.aspx.cs" Inherits="ASPnet._41MainPage" %>
<asp:Content ID="Content1" ContentPlaceHolderID="head" runat="server">
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="server">
    <h1>MainPage</h1>
</asp:Content>

例子改要的最後憑空寫出來才算是學會

接著做/ASPnet/42Login.aspx

ASPnet/33Member_Registeration 有做驗證信註冊

雜湊只能單一方向比對方式要雜湊完後去比對

首先先刻前端

用webform就要盡量用控制項

不然就要用form 然後用 javascript 寫 post

javascript post - Google SearchGoogle

刻完後就到/ASPnet/42Login.aspx.cs寫後端

引入 using System.Data.SqlClient;using System.Configuration;物件庫

SqlConnection 資料庫連接物件利用 ConfigurationManager 組態經理物件

SqlCommand 資料庫指令物件但基於資安(如下補充)必須使用資料庫物件方法Parameters.AddWithValue(“@參數代號，資料庫欄位名稱”)

hasbyte ( sqlserver 指令雜湊密碼

hashbytes - Google SearchGoogle

SqlDataReader 讀資料庫物件

ExecuteReader() 執行讀資料庫物件

但是就算驗證登入後只要記得網址直接 key網址也能進入那怎辦呢 ?

Session

Web 技術中的 Session 是什麼？

藉由 Session (狀態保留(暫存包? 生命週期會同網頁/網站/瀏覽器關閉消失

把門票與登入者姓名暫存到這個包裹內轉移到後端

這時Master page主頁面的效益就來了只要把檢查session寫在主頁其他頁面就都吃的到不用重複寫

登出時要多寫清空 session

Mvc 也可以用 session 可以穿越很多 controller 但 viewdata viewtemp viewbag 生命週期不一樣會在特別講一次 ???

以下方式為主頁面包含側欄頁面排版格式與cs (類似mvclayout) 藉由登入頁面進入到內容頁面

### /ASPnet/Site1.Master

<%@ Master Language="C#" AutoEventWireup="true" CodeBehind="Site1.master.cs" Inherits="ASPnet.Site1" %>

<!DOCTYPE html>

<html>
<head runat="server">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
    <title></title>
    <link href="Content/bootstrap.min.css" rel="stylesheet" />
    <asp:ContentPlaceHolder ID="head" runat="server">
    </asp:ContentPlaceHolder>
</head>
<body>
    <form id="form1" runat="server">
        <div class="container">
            <div class="row">
                <header class="col-md-12">
                    header
                </header>
            </div>
            <div class="row">
                <aside class="col-md-3">
                    aside
                </aside>
                <article class="col-md-9">
                    <asp:ContentPlaceHolder ID="ContentPlaceHolder1" runat="server">
                    </asp:ContentPlaceHolder>
                </article>
            </div>
            <div class="row">
                <footer class="col-md-12">
                    footer
                </footer>
            </div>

        </div>
    </form>
</body>
</html>

### /ASPnet/Site1.Master.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace ASPnet
{
    public partial class Site1 : System.Web.UI.MasterPage
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            if (Session["id"] == null)
                Response.Redirect("42Login.aspx");
        }
    }
}

### /ASPnet/42Login.aspx

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="42Login.aspx.cs" Inherits="ASPnet._42Login" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
    <title></title>
    <link href="Content/bootstrap.min.css" rel="stylesheet" />
</head>
<body>
    <form id="form1" runat="server">
        <div class="container">
            <div class="form-group">
                <label class="col-form-label" for="txtAccount">帳號:</label>
                <asp:TextBox ID="txtAccount" runat="server" CssClass="form-control"></asp:TextBox>
            </div>
            <div class="form-group">
                <label class="col-form-label" for="txtPswd">密碼:</label>
                <asp:TextBox ID="txtPswd" runat="server" CssClass="form-control" TextMode="Password"></asp:TextBox>
            </div>

            <asp:Button ID="Button1" runat="server" Text="登入" CssClass="btn btn-primary" OnClick="Button1_Click" />
        </div>


        

    </form>
</body>
</html>

### /ASPnet/42Login.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;

namespace ASPnet
{
    public partial class _42Login : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {

        }

        protected void Button1_Click(object sender, EventArgs e)
        {
            SqlConnection Conn = new SqlConnection(ConfigurationManager.ConnectionStrings["MySystemConnectionString1"].ConnectionString);
            SqlCommand Cmd = new SqlCommand("select * from members where Account=@account and pswd=hashbytes('sha2_256',@pswd)", Conn);
            Cmd.Parameters.AddWithValue("@account", txtAccount.Text);
            Cmd.Parameters.AddWithValue("@pswd", txtPswd.Text);
            SqlDataReader rd;
            Conn.Open();
            rd = Cmd.ExecuteReader();
            if(rd.Read())
            {
                Session["id"] = rd["Account"];
                Session["name"] = rd["Name"];
                Response.Redirect("41MainPage.aspx");
            }
            else
            {
                Response.Write("<script>alert('帳密錯誤!!')</script>");
            }

            Conn.Close();

        }
    }
}

### /ASPnet/41MainPage.aspx

<%@ Page Title="" Language="C#" MasterPageFile="~/Site1.Master" AutoEventWireup="true" CodeBehind="41MainPage.aspx.cs" Inherits="ASPnet._41MainPage" %>
<asp:Content ID="Content1" ContentPlaceHolderID="head" runat="server">
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="server">
    
    <h1><asp:Label ID="Label1" runat="server" Text=""></asp:Label>MainPage</h1>
</asp:Content>

### /ASPnet/41MainPage.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace ASPnet
{
    public partial class _41MainPage : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            Label1.Text = "歡迎"+Session["Name"]+"光臨本站!!";
        }
    }
}