管理asp会话

Question

我有一个允许我的asp页面进行会话的代码。但是，当我尝试使用张贴表单，带我到另一个asp页面时，我会自动注销。有针对这个的解决方法吗？提前致谢。

<%session("cLoginId") = Request.QueryString("cLoginId") 
session("Email") = Request.QueryString("Email") 
session("cPW") = Request.QueryString("cPW") 
session("UsrId") = csng(Request.QueryString("UsrId")) 
UsrId = csng(Request.QueryString("UsrId")) 
Set Con= server.CreateObject("ADODB.Connection") 
Con.Open "Provider=SQLOLEDB;Initial Catalog="&session("db")&";Data Source="&session("SqlServer")&";UID="&session("uid")&";PWD="&session("pwd")&";" 

mode = Request.QueryString("mode") 
UsrId = csng(Request.QueryString("UsrId")) 

cDesc1=CInt(Request.QueryString("c1")) 
cStartDte = Request.form("sStartDte") 
cEndDte = Request.form("sEndDte") 
p=Request.QueryString("p") 
'session("cLoginId") = Request.QueryString("cLoginId") 
cPW = Request.QueryString("cPW") 
'Response.Write "cDesc1=" & cDesc1 & "<br>" 
'Response.Write "PW=" & session("cPW") & "<br>" 
cMsg = Request.QueryString("cMsg") 
'Response.Write "<font color=white>db2=" & session("SqlServer") & "</font><br>" 
session("cLoginId") = Request.QueryString("cLoginId") 
if cDesc1 <> "" then 
session("cLoginId") = Request.QueryString("cLoginId") 
cEmail= "cLoginId"&"Email"&"cPW" 
end if 
colorh3 = 1 
%> 

<% 
sub ChkUsrDetails(NewsRs) 
    set rsUser = Server.CreateObject("ADODB.Recordset") 
    UserSQL="SELECT * FROM Login where loginid='"&trim(NewsRs("UsrName"))&"'" 
    'Response.Write "UserSQL=" & UserSQL 
    rsUser.Open UserSQL,ObjConn,3 

    if not rsUser.EOF then 
     cFName = rsUser("FName") 
     cLName = rsUser("LName") 
     cUnit = rsUser("Unit") 
    end if 
end sub 
%> 

Answer 1

这是一个非常糟糕的主意，因为你通过这将是所有人都能看到一个查询字符串路过的登录信息。而是将这些变量移动到不能被用户篡改的常量/预置变量。至于用户登录时的会话，请在代码中设置一次，然后检查是否在需要使用它的任何页面上为空。如果空白，您可以将用户重定向回登录页面。

E.g.在page_requires_session.asp：

<% 
If Session("UserID") = "" Then 
    Redirect("login.asp?expired=1") 
End If 
%> 
<!-- Rest of page --> 

然后在login.asp：

<% 
If Request.QueryString("expired") = "1" Then 
    Response.Write "Your session has expired; please log in again" 
End If 

If Request.Form("submit") = "Login" Then 
    ' check in database if user info. matches valid username and password ' 
Else 
    ' display error message 
End If 
%> 
<!-- HTML form would be here -->