如何在sql命令中使用c#变量

Question

这就是我想要使用的;

string insertQuery = @"insert into userinfo (UserName, FirstName, LastName, 
                      E-mail, Password,  Country) 
                      values ( '" + uname + "', '" + fname + 
                      "','" + lname + "', '" + email + "')";

其中+之间的每个变量都是带有值的字符串变量.但是当我运行此命令时,我得到一些不正确的语法错误.

这是我得到的新错误;

errorSystem.Data.SqlClient.SqlException(0x80131904):字符串或二进制数据将被截断.该语句已终止.在System.Data.SqlClient.SqlConnection.OnError(SqlException异常,布尔breakConnection,动作1 wrapCloseInAction) at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action1个wrapCloseInAction)在System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj,布尔callerHasConnectionLock,布尔asyncClose)在System.Data.SqlClient.TdsParser. System.Data.SqlClient.SqlCommand.RunExecuteReaderTds中的System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds,RunBehavior runBehavior,String resetOptionsString)中的TryRun(RunBehavior runBehavior,SqlCommand cmdHandler,SqlDataReader dataStream,BulkCopySimpleResultSet bulkCopyHandler,TdsParserStateObject stateObj,Boolean&dataReady) (CommandBehavior cmdBehavior,RunBehavior runBehavior,Boolean returnStream,Boolean async,Int32 timeout,Task&task,Boolean asyncWrite,SqlDataReader ds)at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior,RunBehavior runBehavior,Boolean returnStream,String method,TaskCompletionSource 1 completion, Int32 timeout, Task& task, Boolean asyncWrite) at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource1完成,字符串 systemName,Boolean sendToPipe,Int32 timeout,Boolean asyncWrite)atRegistrationPage.Button1_Click1(Object sender,EventArgs e)in C:\ Users\kristhnen.jagambrum\Documents\Visual Studio 2012\Projects\Registration\Registration\RegistrationPage.aspx.cs:第50行ClientConnectionId:6d959e49-5b62-43be-b202-76f7eb1fbd2c

Answer 1

您提出的问题非常好 - 您展示的代码是一行中两个安全问题的完美例证:

• 表结构说明了黑客窃取用户密码的原因.
• C#代码使SQL注入攻击成为可能.

解决第一个问题很难:您需要了解密码散列以及如何在DB中存储用户信息.这是一个有用的问答:在DB中存储密码的最佳方式

第二个问题更容易 - 您只需要用参数名替换注入的值,然后为每个参数名添加值:

... // Create SQL command, then set its text
command.CommandTest = @"INSERT INTO userinfo (
    UserName, FirstName, LastName, E-mail, Password_hash, Password_salt, Country
) VALUES ( @uname, @fname, @lname, @email, @pwd_hash, @pwd_salt, @country)";
// Bind the parameters
command.Parameters.Add(new SqlParameter("@uname", uname));
command.Parameters.Add(new SqlParameter("@fname", fname));
... // ...and so on
command.ExecuteNonQuery();