这个TSQL查询有什么问题？

Question

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
    Literal1.Text = Request.QueryString("Pno")
    On Error Resume Next
    Dim SQLData As New System.Data.SqlClient.SqlConnection("workstation id=ws.example.com;packet size=4096;user id=some-user;pwd=some-password;data source=mssql.example.com;persist security info=False;initial catalog=some-db")
    Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT * FROM a1_ticket WHERE PNR_no ='" & Literal1.Text & "'", SQLData)
    SQLData.Open()
    Dim dtrReader As System.Data.SqlClient.SqlDataReader = cmdSelect.ExecuteReader()
    If dtrReader.HasRows Then
        While dtrReader.Read()
            Literal2.Text = dtrReader("bus_type")
            Literal3.Text = dtrReader("dep_time")
            Literal4.Text = dtrReader("PRN")
            Literal5.Text = dtrReader("fro_m")
            Literal6.Text = dtrReader("seat_opt")
            Literal7.Text = dtrReader("Ticket_no")
            Literal8.Text = dtrReader("t_o")
            Literal9.Text = dtrReader("taxes")
            Literal10.Text = dtrReader("Travels")
            Literal11.Text = dtrReader("journey_date")
            Literal12.Text = dtrReader("net_pay")
            Literal13.Text = dtrReader("name")
            Literal14.Text = dtrReader("seat_opt")
            Literal15.Text = dtrReader("sel_seat")
            Literal16.Text = dtrReader("bd_point")
        End While
    Else
    End If
    Dim cmd As New System.Data.SqlClient.SqlCommand("SELECT * FROM a1_vendors WHERE UserId ='" & Request.QueryString("tid") & "'", SQLData)
    cmd.ExecuteScalar()
    Literal17.Text = dtrReader("travels")
    Literal18.Text = dtrReader("Contactno")
    SQLData.Close()
    dtrReader.Close()
    SQLData.Close()
End Sub

Answer 1

这个查询出了什么问题？它正在乞求SQL注入攻击.

看到:

Dim cmd As New SqlCommand(
   "SELECT * FROM a1_vendors WHERE UserId ='" & 
   Request.QueryString("tid") & "'", SQLData)

如果Request.QueryString("tid")包含值" '' GO DROP TABLE a1_vendors GO SELEC ''",该怎么办？

突然你的命令变成了" SELECT * FROM a1_vendors WHERE UserId = '' GO DROP TABLE a1_vendors GO SELECT ''"