A brief discussion of the security of ASP based on my experience with the "hacker"

I made a website www.zydn.net, it is a personal homepage, although not in the name of the individual, but it is only me to do this thing, I stand a set of back-Office system, with ASP, the host with the million nets, but yesterday I surf the internet, found that my investigation was changed, I thought it was my own input wrong. Quickly changed back, but after a while it was changed, but also changed more severe: The survey is, asked me to write a software is useful, I prepared the answer is:
Useful, helpful, completely useless,
He changed it for me: it's useless, what's the help? Totally useless.
Also, I have a caption, said that my software is good, I own of course say oneself good, he actually gave me to make
It's a bunch of weeds, but there's a lot of weed on the net, and some personal attacks.!!!
Also changed some of my column name, I am very angry.
Because my website uses the backstage system to control, therefore I guessed that he has entered the backstage.
I put a backstage demo program in a subdirectory of the station, and the ASP page verification is a legitimate user is to determine whether the session of the password is null to achieve, so as long as the advanced subdirectory into the background of the demo, and then enter the background of the site file name may enter, So I deleted all the demo, but I found out that he was still doing the damage!!
I have heard of the use of special code to do the password, but I did not try, also did not care, but did not want to go into other people's backstage, I think he is not using this method? So overnight change procedures, I think he will come again, put a detection of IP program, and check the content of his program, the results found that he was in the password entered an ' or ' = ' into my website, I also tried a, sure enough,
So immediately started, so that every page test please password to be compared with the library password, finally, he did not come in the!!! Also perfected the record log, noted the "attack" type, time, IP, input characters, administrator into the time, IP and so on. In my log, I left that friend's exploits, and he tried to get into my station with ' or ' = with ' or ' for nearly one hours.
But the general library is too slow, so I saved the password in the library to a file name is very strange, the extension of ASP files, the contents of the file is: <% mimaint=*****%> inserted into the ASP page, so it seems to be faster. And I looked at the special statements they entered, unexpectedly have to use SQL statement to delete my record, although this statement did not succeed, but I still afraid that the master made a success, so simply add a statement, found that there are single quotes, all think is illegal password. I also want to see whether it is always the same person, so give each one to lose the password, or know my background file name to try to enter the browser has stored a cookie, numbered. Ha ha.. Later I read it all interesting, well, I can do it, I know, for a real master, this is only a paper-wrapped fire, but less can make my program a little safer. If someone attacks the server, get my source code, it must be all empty words, Oh... I'm not afraid, I just find million net accounts .... Return me thousands of oceans to!!!. ）