The following is the implementation of the effect diagram:
First click on the map of the railway booking link, will open http://Student information Platform website/logintotrainsite.asa page.
The approximate code for the Logintotrainsite.asa page is as follows:
Copy Code code as follows:
<%
Response.Buffer = True
Response.ExpiresAbsolute = Now ()-1
Response.Expires = 0
Response.CacheControl = "No-cache"
Response.AddHeader "Pragma", "No-cache"
Get user name and password based on user session
%>
<body>
<div style= ' Display:none ' >
<form name= "MyForm" method= "post" action= "http://train booking website/loginfromothersite.aspx" >
<input type= "hidden" name= "UserName" value= "<%=userName%>"/>
<input type= "hidden" name= "Userpwd" value= "<%=userPwd%>"/>
</form>
</div>
</body>
<script language= "JavaScript" >
Myform.submit ();
The code for the </script> LoginFromOtherSite.aspx.cs page is roughly as follows:
using (SqlConnection conn = new SqlConnection (sqlhelper.studentconnectionstring))
{
String sql = "Select T_stuuser.id, T_stuuser.stunumber, T_stuuser.userpassword, T_stuuser.realname, v_ Stuuser.classname, V_stuuser.departmentname "
+ "from T_stuuser,v_stuuser where t_stuuser.stunumber= @UserName and t_stuuser.userpassword= @UserPwd and V_ Stuuser.stunumber= @UserName ";
SqlCommand cmd = new SqlCommand (SQL, conn);
SqlParameter pusername = cmd. Parameters.Add ("@UserName", SqlDbType.VarChar, 30);
SqlParameter puserpwd = cmd. Parameters.Add ("@UserPwd", SqlDbType.VarChar, 150);
Pusername.value = request.form["UserName"];
Puserpwd.value = request.form["Userpwd"];
Conn. Open ();
SqlDataReader SDR = cmd. ExecuteReader (commandbehavior.closeconnection);
if (SDR). Read ())
{
session["UserID"] = convert.tostring (sdr["ID"));
session["stuname"] = convert.tostring (sdr["realname"));
session["Stunumber"] = convert.tostring (sdr["Stunumber"));
session["academe"] = convert.tostring (sdr["Departmentname"));
session["ClassName"] = convert.tostring (sdr["ClassName"));
Response.Redirect ("myorder.aspx"); Login successful
}
Else
{
Response.Redirect ("default.aspx"); Logon failure, user name or password error
}
}
The last loginfromothersite.aspx page has finished processing two sites are users are logged in state. But I want to know where it's not safe to use this method,
There may be some security problems, I hope to have a friend who knows what to tell me.
