这些语句里有SQL注入漏洞？？谁知道告诉我下 谢谢

[laeep]

if request.Form("action")="modifychange" then
if request.Form("OldPassword")="" then
Response.Write("<script>alert(""请输入旧密码"");location=""javascript:history.back()"";</script>")
Response.End
end if
if request.Form("NewPassword")="" then
Response.Write("<script>alert(""请输入新密码"");location=""javascript:history.back()"";</script>")
Response.End
end if
if request.Form("ConfimPassword")="" then
Response.Write("<script>alert(""请输入确认新密码"");location=""javascript:history.back()"";</script>")
Response.End
end if
if request.Form("ConfimPassword")<>request.Form("NewPassword") then
Response.Write("<script>alert(""两次输入密码不正确"");location=""javascript:history.back()"";</script>")
Response.End
end if

Set Rs1 = server.createobject("adodb.recordset")
SQL1 = "select * from userr where userrName='"&Request.Cookies("F")("userrMame")&"' and Password='"&MD5(Replace(Trim(Request.Form("OldPassword")),"'","''"),16)&"'"
Rs1.open SQL1,Conn,1,1
if Not Rs1.eof then
Set RsConfig = server.createobject("adodb.recordset")
SQL = "select * from userr where userrName='"&Request.Cookies("F")("userrName")&"' and Password='"&Request.Cookies("F")("MemPassword")&"'"
RsConfig.open SQL,Conn,1,3
if Not Rsconfig.eof then
Rsconfig("password")=md5(Replace(Trim(Request.Form("NewPassWord")),"'","''"),16)
RsConfig.update
RsConfig.close
Set Rsconfig=nothing
Response.Write("<script>alert(""修改密码成功"");location=""UserMain.asp"";</script>")
Response.End
else
Response.Write("<script>alert(""脚本过期"");location=""javascript:history.back()"";</script>")
Response.End
end if
else
Rs1.close
set Rs1=nothing
Response.Write("<script>alert(""你输入的旧密码不正确或者没有此用户"");location=""javascript:history.back()"";</script>")
Response.End
end if
end if

[wangwm]

应该没有吧

[laeep]

但是怎么有人注入了 还列出了我所有的表来 他说的就是这个

[laeep]

对了 问下 那个NBSI 是通过什么漏洞（方法）得到库中所有表的

[huejim]

u de Cookies haha

[wangwen1759]

不是你这些代码的问题，是在显示正文的页面，传递字符比如id，没有过滤特殊字符

[wangwm]

NBSI以数值型注入和字符型注入，然后通过猜测得到数据表的名称

[laeep]

能不能说下原理 比如举个例子

[wangwm]

参考这篇文章
http://tech.tfol.com/techs/wlxx/block/html/2005032400309.html