關於登錄會話

我正在做我關於開發一個網站的項目。我是新來的ASP.net，現在我有一個關於登錄會話的問題，當用戶登錄時，每個人都在同一網上衝浪時間也記錄爲該用戶，不管他們是否登錄。會話僅在有人點擊註銷按鈕並且所有人都註銷時結束。請幫幫我。每一個幫助將不勝感激。這裏是我的代碼，我在主網頁代碼中的這些事情：關於登錄會話

protected void Page_Load(object sender, EventArgs e) 

    { 

     string equip = "Equipment.aspx"; 
     string url = HttpContext.Current.Request.Url.AbsoluteUri; 
     if (url.IndexOf(equip) != -1) { Calendar2.Visible = false; Image1.Visible = false; } 
     equip = "Bookings.aspx"; 
     if (url.IndexOf(equip) != -1) { Calendar2.Visible = false; Image1.Visible = false; } 
     equip = "Rooms.aspx"; 
     if (url.IndexOf(equip) != -1) { Calendar2.Visible = false; Image1.Visible = false; } 
     equip = "Users.aspx"; 
     if (url.IndexOf(equip) != -1) { Calendar2.Visible = false; Image1.Visible = false; } 

     if (!Page.IsPostBack) 
     { 
      if (user != "" && user != null) 
      { 
       loginStatus = true; 
       redirectpage = false; 

      } 
      else 
      { 

       redirectpage = false; 
       loginStatus = false; 
       user = ""; 
       authority = 0; 
      } 

     } 
     else 
     { 

      if (user == "" || user==null) 
      { 

       if (cal != null) 
       { 

       } 
       loginStatus = false; 
       authority = 0; 
      } 
      else 
      { 
       if (cal != null) 
       { 

       } 
       loginStatus = true; 
      } 
     } 
    } 

/// <summary> 
/// Responds to a login request, validating details against the database and 
/// loading the user into the session if successful. 
/// </summary> 
/// <param name="sender">The sending object.</param> 
/// <param name="e">The event arguments.</param> 

protected void Login_Authenticate(object sender, AuthenticateEventArgs e) 
{ 

SqlConnection oConn = 
new SqlConnection(); 
oConn.ConnectionString = @"Data Source=STAVROS\SQLEXPRESS;User ID=sa;Password=123abc;Initial Catalog=webdev"; 

sSQL = "select * from tbl_user where username = '" + Login.UserName + "'AND password = '" + Login.Password + "' "; 
SqlCommand oComm1 = new SqlCommand(sSQL, oConn); 

try 
{ 

oConn.Open(); 
SqlDataReader i = oComm1.ExecuteReader(); 
if (i.HasRows) 
{ 
while (i.Read()) 
{ 
user = i.GetString(0); 
authority = i.GetInt16(7); 

loginStatus = true; 
string url = HttpContext.Current.Request.Url.Absolute… 
string p = "Home.aspx"; 
if (url.IndexOf(p) != -1) { Response.Redirect("Home.aspx"); } 
Helper.CreateUserSession(Session, user); 
} 

} 
else 
{ 
loginStatus = false; 
Login.FailureText = "Invalid username or password."; 
} 


i.Close(); 
} 
catch (Exception ex) 
{ 
Response.Redirect("room-book.aspx"); 

} 

} 

/// <summary> 
/// Logs the user out (kills the session) 
/// </summary> 
/// <param name="sender">The sender</param> 
/// <param name="e">The event arguments</param> 

protected void btnLogout_Click(object sender, EventArgs e) 
{ 

loginStatus = false; 
user = ""; 
authority = 0; 
Response.Redirect("Home.aspx"); 
}

來源

2012-07-28 Phat Nghiem sy

發佈您的'Helper.CreateUserSession'代碼在那裏會有些腥意。 *另外，您需要檢查SQL注入攻擊* – nunespascal 2012-07-28 03:52:42

唯一可能導致此行爲的原因是'loginStatus'是一個靜態字段。這不是asp.net認證。閱讀Jason提供的鏈接。 – nunespascal 2012-07-28 03:58:01