sql injection – משהו יכול?

דרך אגב…
אני ידעתי לבנות כניסת משתמשים כזו בעבר, רק שעכשיו שיפרתי אותה באבטחה..

ורמז קטן:
שם המשתמש זה: yaron

אוקי…הינה זה מה שעשיתי…


<% if Request.Form("user") = "" then %><center><font class='text'>Login Faield. Try Again.<% Response.End %><% End if %>
<% if Request.Form("pass") = "" then %><center><font class='text'>Login Faield. Try Again.<% Response.End %><% End if %>
<%
u = Request.Form("user")
u = Replace(u, """", """)
u = replace(u, "'", """)
u = Replace(u, "<", "<")
u = Replace(u, ">", ">")
u = Replace(u, "(", "(")
u = Replace(u, ")", ")")
u = Replace(u, "=", "=")
u = trim(""& u &"")

p = Request.form("pass")
p = Replace(p, """", """)
p = replace(p, "'", """)
p = Replace(p, "<", "<")
p = Replace(p, ">", ">")
p = Replace(p, "(", "(")
p = Replace(p, ")", ")")
p = Replace(p, "=", "=")
p = trim(""& p &"")

user = u
pass = p

%>
<%
set CS=server.createobject("adodb.connection")
CS="provider=microsoft.jet.oledb.4.0; data source="& server.MapPath("YouDontSeeThat.mdb") &""
set RS=server.createobject("adodb.recordset")
RS.activeconnection=CS

RS.open "select * from phoneu where user = '"& user &"' and pass = '"& pass &"' "

If RS.EOF then ' rong pass
Response.write "<center><font class='text'>Login Faield. Try Again."
Response.End
Else
Response.write "<center><font class='text'>Good..you are connect to the web…!"
End if
%>

תראה ותגיד לי עם זה טוב בבקשה….


u = Request.Form("u")
u = Replace(u, """", """)
u = replace(u, "'", """)
u = replace(u, "", "ללא תוכן")
u = Replace(u, "<", "<")
u = Replace(u, ">", ">")
u = Replace(u, "(", "(")
u = Replace(u, ")", ")")
u = Replace(u, "=", "=")
u = Replace(u, "select", "Select")
u = Replace(u, "insert", "inSert")
u = Replace(u, "fields", "Fields")
u = Replace(u, "request", "request")
u = Replace(u, "redirect", "redirect")
u = Replace(u, "response", "response")
u = trim(""& u &"")

p = Request.form("p")
p = Replace(p, """", """)
p = replace(p, "'", """)
p = replace(p, "", "ללא תוכן")
p = Replace(p, "<", "<")
p = Replace(p, ">", ">")
p = Replace(p, "(", "(")
p = Replace(p, ")", ")")
p = Replace(p, "=", "=")
p = Replace(p, "select", "Select")
p = Replace(p, "insert", "inSert")
p = Replace(p, "fields", "Fields")
p = Replace(p, "request", "request")
p = Replace(p, "redirect", "redirect")
p = trim(""& p &"")

ותודה!