package main

import (
	"fmt"
	"html/template"
	"log"
	"net/http"
)

func login(w http.ResponseWriter, r *http.Request) {
	r.ParseForm()
	fmt.Println("method:", r.Method) //获取请求的方法
	if r.Method == "GET" {
		t, _ := template.ParseFiles("login.gtpl")
		log.Println(t.Execute(w, nil))
	} else {
		//请求的是登录数据,那么执行登录的逻辑判断
		//fmt.Println("username:", r.Form["username"])
		//fmt.Println("password:", r.Form["password"])
		fmt.Println("username:", template.HTMLEscapeString(r.Form.Get("username"))) //输出到服务器端
		fmt.Println("password:", template.HTMLEscapeString(r.Form.Get("password")))
		//template.HTMLEscape(w, []byte(r.Form.Get("username"))) //输出到客户端
		t, err := template.New("foo").Parse(`{{define "T"}}Hello, {{.}}!{{end}}`)
		err = t.ExecuteTemplate(out, "T", template.HTML("<script>alert('you have been pwned')</script>"))
	}
}

func main() {
	http.HandleFunc("/login", login)         //设置访问的路由
	err := http.ListenAndServe(":9090", nil) //设置监听的端口

	if err != nil {
		log.Fatal("ListenAndServe: ", err)
	}
}

login.gtpl

<html>
<head>
<title></title>
<script type="text/javascript">
 var checkSubmitFlg = false; //防止表单重复提交标示符
      function myCheck()
      {


        if(checkSubmitFlg ==true){
            return false; //当表单被提交过一次后checkSubmitFlg将变为true,根据判断将无法进行提交。
        }

        for(var i=0;i<document.form1.elements.length-1;i++)
        {
         if(document.form1.elements[i].value=="")
         {
           alert("当前表单不能有空项");
           document.form1.elements[i].focus();
           return false;
         }
        }
        checkSubmitFlg ==true; 
        return true;

      }
    </script>
</head>
<body>
<form name="form1" action="/login?username=astaxie" method="post" onSubmit="return myCheck()">
	用户名:<input type="text" name="username">
	密码:<input type="password" name="password">
	<input type="submit" value="登录">
</form>
</body>
</html>