/// <summary>
/// 认证用户
/// </summary>
/// <param name="userName">用户名</param>
/// <param name="password">密码</param>
/// <returns>如果登录成功，返回true，否则返回false。</returns>
private bool authenticate(string userName, string password)
{
string sql = "SELECT RealName, Password, Salt FROM Users WHERE UserName = @userName";
string salt = string.Empty;
Session.Timeout = 30;
using (IDataReader dr = DBHelper.ExecuteReader(sql, new SqlParameter("@userName", userName)))
{
if (dr.Read())
{
salt = dr["Salt"].ToString();
string hashed = PasswordDigest.GetHashSha256(tbPassword.Text, salt);
if (hashed.Equals(dr["Password"])) // 认证成功
{
Session["UserName"] = userName;
Session["RealName"] = dr["RealName"];
Session["FailureCount"] = 0; // 失败登录计数清零
return(true);
}
}
//设置失败登录次数
if (Session["FailureCount"] == null)
{
Session["FailureCount"] = 1;
}
else
{
int failureCount = ((int)Session["FailureCount"]) + 1;
dvCaptcha.Visible = failureCount > 2; //连续失败3次以上显示
Session["FailureCount"] = failureCount;
}
return(false);
}
}
protected void btnOK_Click(object sender, EventArgs e)
{
if (IsValid)
{
string sql = "INSERT INTO Users(UserName, Password, Salt, Email, RealName, Gender, Phone, Dob) " +
"Values(@userName, @password, @salt, @email, @realName, @gender, @phone, @dob)";
SqlParameter pUserName = new SqlParameter("@userName", tbUserName.Text.Trim());
string salt = string.Empty;
string hashed = PasswordDigest.GetHashSha256AndSalt(tbPassword1.Text, out salt);
SqlParameter pPassword = new SqlParameter("@password", hashed);
SqlParameter pSalt = new SqlParameter("@salt", salt);
SqlParameter pEmail = new SqlParameter("@email", tbEmail.Text.Trim());
SqlParameter pRealName = new SqlParameter("@realName", tbRealName.Text.Trim());
SqlParameter pGender = new SqlParameter("@gender", Request.Params["Gender"]);
SqlParameter pPhone = new SqlParameter("@phone", tbPhone.Text.Trim());
SqlParameter pDob = new SqlParameter("@dob", DateTime.Parse(Request.Params["Dob"].Trim()));
if (DBHelper.ExecuteSql(sql, pUserName, pPassword, pSalt, pEmail, pRealName, pGender, pPhone, pDob) == 1)
{
dvMessage.Visible = true;
dvRegisterForm.Visible = false;
}
}
}