听说登录有许多漏洞，包括'or'='or'漏洞等特殊符号漏洞，我知道的不多，以下是我写的登录代码，麻烦大家看一下，有没有什么漏洞…………谢谢…………

代码如下：
<!--#include file="admin/Coon.asp" -->
<!--#include file="Admin/md5code.asp" -->

<%
if request("action")="login" then
user=request.form("user")
pass=md5(request.form("pass"))

If Trim(Request.Form("validatecode"))=Empty Or Trim(Session("cnbruce.com_ValidateCode"))<>Trim(Request.Form("validatecode")) Then
response.write("The Code is incorrect.")
response.end
end if
if user="" or pass="" then
response.Write("<script language=javascript>alert('Some textarea is emporty');history.go(-1)</script>")
end if

sql="SELECT * FROM D_Member WHERE M_User='" & Replace(user,"'","''") & "' and M_Password='" & Replace(pass,"'","''") & "'"
set rs=conn.execute(sql)

if rs.eof or rs.bof then
response.write "<script language=javascript>"
response.write "alert('Error:The user or password is incorrect!');"
response.write "javascript:history.go(-1);"
response.write "</script>"

else

set rs=server.createobject("adodb.recordset")
sql="select * from D_Member where M_User='"&user&"'"
rs.open sql,conn,1,1
'set session
session.Timeout=180
session("jUser")=user
session("jPass")=pass
session("jClass")=rs("M_Class")
rs.close
set rs=nothing

Response.redirect "index.asp"

end if

end if
%>

如果有的话，请大家提个醒啊…………