这个出错怎么解决

[飞扬残月]

<%set rs=server.Createobject("adodb.recordset")
sql="select * from user where username="&username&""
rs.Open sql,conn,3,3
if not rs.eof then
if trim("password")=trim(rs("password")) then
response.write"<br><br><br><center>欢迎你 <font color=blue> "&username&" </font>,你的密码是<font

color=red> "&password&" </font> ,你已经成功登录系统,可以正常使用"
else
Response.write"<script>alert('请检查你选择的用户名和输入的密码是否正确！

',history.back())</script>"
end if
end if
%>
不管怎么样都能登陆，

[stefli]

sql="select * from [user] where username='"&username&"'"

[飞扬残月]

现在是不管怎么样都不能登陆

[pizixt]

<%
set rs=server.Createobject("adodb.recordset")
password=trim(password)
sql="select * from [user] where username='"&username&"' and password='"&password&"'"
rs.Open sql,conn,1,1
if not rs.eof then
response.write "<br><br><br><center>欢迎你 <font color=blue> "&username&" </font>,你的密码是<font color=red> "&password&" </font> ,你已经成功登录系统,可以正常使用"
else
response.write "<script language=javascript>alert('请检查你选择的用户名和输入的密码是否正确！';history.back()</script>"
end if
%>

[possible_Y]

sql="select * from user where username='"&username&"'"
rs.Open sql,conn,3,3
if not rs.eof then
if rs("password")=trim(rs("password")) then '不是trim("password")

[possible_Y]

if trim(password)=trim(rs("password")) then '不是trim("password")


上面写错了点

[guokai1217]

注意以下过滤特殊的字段.否则漏洞好象明显了一些.很不安全.
<%
Function Deal(exp1)
dim exp2
exp2=Replace(exp1,"<","<")
exp2=Replace(exp2,">",">")
exp2=Replace(exp2,"'","''")
exp2=Replace(exp2,Chr(13),"<br>")
Deal=exp2
End Function
%>
用
name=Deal(name)过滤一下吧.
密码也一样.最好加个密再存,再验证.