实用便利的Asp.Net的防黑代码[网络技术]

看我写的一段代码:

protected void btnLogin_Click(object sender, EventArgs e)
    {
        #region
        if (tbUserName.Text == "" || tbPassWord.Text == "")
            Response.Write("<script>alert('用户名或密码不能为空');</script>");
        else
        {
            string ConnectionString = System.Configuration.ConfigurationSettings.AppSettings["OraConnString"];
            string strSql = string.Format("select * from manager where UserName='{0}' and PassWord='{1}' ", tbUserName.Text, tbPassWord.Text);
            using (OracleConnection conn = new OracleConnection(ConnectionString))
            {
                conn.Open();

                using (OracleCommand cmd = new OracleCommand(strSql, conn))
                {
                    try
                    {
                        OracleDataReader check = cmd.ExecuteReader();
                        if (check.HasRows)
                        {
                            check.Read();
                            Session["UserCheck"] = tbUserName.Text.Trim();
                            if (Convert.ToInt16(check["admin

state"].ToString()) == 1)
                                Session["admin"] = "OK";
                            Response.Redirect("ShowWork.aspx");
                        }
                        else
                        {
                            lbState.Text = "用户名或密码错误!";
                        }
                    }
                    catch(System.Exception)
                    {
                        Response.Write("<script>alert('服务器呈现了未知错误,请确认您的用户名和密码

[1] [2]  下一页