网站后台修密码不法运行帮我看看
网站后台修密码不法运行帮我看看<!--#include file="conn.asp"-->
<!--#include file="../Inc/mlConfig.asp"-->
<!--#include file="../Inc/mlFunction.asp"-->
<!--#include file="mlChkAdmin.asp"-->
<!--#include file="../Inc/MD5.asp" -->
<%
action=Trim(Request.QueryString("action"))
%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
<title><%=BackSiteTitle%></title>
<link href="main.css" rel="stylesheet" type="text/css" >
<script language="javascript">
function CheckForm()
{
if (document.mlform.OldPass.value=="")
{
alert("原密码不能为空！");
document.mlform.OldPass.focus();
return false;
}
if (document.mlform.NewPass.value=="")
{
alert("新密码不能为空！");
document.mlform.NewPass.focus();
return false;
}
if (document.mlform.reNewPass.value=="")
{
alert("确认新密码不能为空！");
document.mlform.reNewPass.focus();
return false;
}
if (document.mlform.reNewPass.value!=document.mlform.NewPass.value)
{
alert("新密码输入不一致！");
document.mlform.reNewPass.focus();
return false;
}
return true;
}
</script>
</head>
<body>
<br><br>
<br>
<br>
<% If action="" Then %>
<form action="Admin_ChgePwd.asp?action=new" method="post" onSubmit="return CheckForm();" name="mlform">
<table width="333" border="0" cellspacing="1" cellpadding="2" align="center" class="a2">
<tr>
<td width="328" class="a1" height="25" align="center">
管理员密码修改
</td>
</tr>
<tr>
<td height="19" width="328" valign="top" class="a3" align="center">
原管理密码:
<input size="15" name="OldPass" type="password">
<br />
新管理密码:
<input size="15" name="NewPass" type="password" />
<br />
确认新密码:
<input size="15" name="reNewPass" type="password" />
<br>
<input type="submit" value=" 确定 " name="Submit">
<input type="reset" value=" 取消 " name="reset">
</td>
</tr>
</table>
</form>
<% End If %>
<%
If action="new" Then
OldPass=Trim(Request.Form("OldPass"))
NewPass=Trim(Request.Form("NewPass"))
AdminName=session("AdminName")
md5OldPass=md5(""&OldPass&"")
md5NewPass=md5(""&NewPass&"")
sql="select * from [administrator] where AdminName='"&AdminName&"'"
set rst= Server.CreateObject("adodb.recordset")
rst.open sql,conn,1,3
if md5OldPass<>rst("AdminPass") then
msg="原密码错误！"
else
rst("AdminPass")=md5NewPass
msg="密码修改成功！"
rst.update
end if
BackStr="<SCRIPT language=javascript>" & vbcrlf
BackStr=BackStr & "alert('" & msg & "');" & vbcrlf
BackStr=BackStr & "location.href='Admin_Main.asp';" & vbcrlf
BackStr=BackStr & "</script>"
response.write BackStr
rst.close
set rst=nothing
end if
%>
</body>
</html>
不该在这问吧。。。。。。
