ASP (Classic ASP) 登錄註冊完整範例：Access/SQL Server + Session 驗證

技術棧確認

**Classic ASP (VBScript/JScript)** ≠ ASP.NET。運行於 IIS + `asp.dll`，副檔名 `.asp`。

資料庫建表 (Access .mdb / SQL Server)

-- Users 表
CREATE TABLE Users (
    UserID AUTOINCREMENT PRIMARY KEY, -- Access 用 AUTOINCREMENT, SQL Server 用 IDENTITY(1,1)
    Username VARCHAR(50) UNIQUE NOT NULL,
    PasswordHash VARCHAR(100) NOT NULL, -- 存雜湊而非明文
    Email VARCHAR(100),
    RegDate DATETIME DEFAULT NOW()
);

連線字串配置 (`conn.asp`)

<%
' conn.asp - 放在網站根目錄或 include 資料夾
Function GetConn()
    Dim conn, connStr
    ' Access 範例 (需將 .mdb 放在不可直接下載的目錄如 App_Data)
    connStr = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath("../App_Data/users.mdb")
    ' SQL Server 範例
    ' connStr = "Provider=SQLOLEDB;Data Source=localhost;Initial Catalog=MyDB;User ID=sa;Password=xxx;"
    
    Set conn = Server.CreateObject("ADODB.Connection")
    conn.Open connStr
    Set GetConn = conn
End Function

Function CloseConn(conn)
    If IsObject(conn) Then
        If conn.State = 1 Then conn.Close
        Set conn = Nothing
    End If
End Function
%>

註冊頁 (`register.asp`)

<%
If Request.ServerVariables("REQUEST_METHOD") = "POST" Then
    Dim username, password, email, conn, rs, sql
    username = Trim(Request.Form("username"))
    password = Request.Form("password")
    email = Trim(Request.Form("email"))
    
    ' 簡單驗證
    If username = "" Or password = "" Then
        Response.Write ""
        Response.End
    End If
    
    ' 密碼雜湊 (經典 ASP 無內建 BCrypt，簡易示範用 SHA256 + Salt，生產請用 COM 組件或升級 ASP.NET)
    Dim salt, pwdHash
    salt = "fixed_salt_" ' 實際應隨機生成並存入 DB
    pwdHash = GetSHA256(password & salt) ' 需自行實現或引用 CAPICOM/第三方 DLL
    
    Set conn = GetConn()
    ' 檢查用戶名是否存在
    Set rs = conn.Execute("SELECT UserID FROM Users WHERE Username = '" & Replace(username, "'", "''") & "'")
    If Not rs.EOF Then
        Response.Write ""
        rs.Close: CloseConn(conn)
        Response.End
    End If
    rs.Close
    
    ' 插入新用戶
    sql = "INSERT INTO Users (Username, PasswordHash, Email) VALUES ('" & _
          Replace(username, "'", "''") & "', '" & pwdHash & "', '" & Replace(email, "'", "''") & "')"
    conn.Execute sql
    CloseConn(conn)
    
    Response.Write ""
End If
%>


用戶註冊

用戶名: 

密碼: 

郵箱: 

註冊

登錄頁 (`login.asp`)

<%
If Request.ServerVariables("REQUEST_METHOD") = "POST" Then
    Dim username, password, conn, rs, sql, pwdHash
    username = Trim(Request.Form("username"))
    password = Request.Form("password")
    
    Set conn = GetConn()
    sql = "SELECT UserID, PasswordHash FROM Users WHERE Username = '" & Replace(username, "'", "''") & "'"
    Set rs = conn.Execute(sql)
    
    If rs.EOF Then
        Response.Write ""
    Else
        pwdHash = rs("PasswordHash")
        ' 驗證雜湊 (此處簡易對比，實際應用恆等比較防時序攻擊)
        If pwdHash = GetSHA256(password & "fixed_salt_") Then
            Session("UserID") = rs("UserID")
            Session("Username") = username
            Session.Timeout = 30 ' 分鐘
            Response.Redirect "welcome.asp"
        Else
            Response.Write ""
        End If
    End If
    rs.Close: CloseConn(conn)
End If
%>


用戶登錄

用戶名: 

密碼: 

登錄

受保護頁面 (`welcome.asp`)

<%
If Session("UserID") = "" Then
    Response.Redirect "login.asp"
    Response.End
End If
%>


歡迎, <%=Session("Username")%> !
登出

登出 (`logout.asp`)

<%
Session.Abandon
Response.Redirect "login.asp"
%>

安全性補強 (Classic ASP 固有限制)

遷移建議

Classic ASP 2006 年停止主流支援，**新專案強烈建議直接使用 ASP.NET Core**。若必須維護舊系統，上述代碼可作為參考基線。