我如何使用双引号操纵查询？

Question

我有一个数据库问题,如果我的SQL是这样的:

Dim Username
Username = request.form(trim("username"))
Username = Replace(username,"'","''") 

Dim email
email = request.form(trim("email"))
email = Replace(email,"'","''")

Dim question
question = request.form(trim("question"))
question = Replace(question,"'","''")

Dim answer
answer = request.form(trim("answer"))
answer = Replace(answer,"'","''")


Dim date_answered
dag = Day(Now())
maand = Month(Now())
jaar = Year(Now())
uur = Hour(Time)
minuten = Minute(Time)
seconden = Second(Time)
datum= jaar & "-" & maand & "-" & dag
tijd = uur & ":" & minuten& ":" & seconden
date_answered = (datum & " " & tijd)

Dim isActive
isActive = "yes"    
sql="UPDATE faqtbl SET "
      sql=sql & "Name='" & username & "',"
      sql=sql & "email='" & email & "',"
      sql=sql & "question='" & question & "',"
      sql=sql & "answer='" & answer & "',"
      sql=sql & "date_answered='" & date_answered & "',"
      sql=sql & "isActive='" & isActive & "'"
      sql=sql & " WHERE ID='" & lngRecordNo &"';"
      on error resume next

直到我想要添加到数据库中的数据使用双引号时才会出现问题.请帮助我如何使用双引号操纵查询？谢谢.. :)

Answer 1

即使数据不使用引号,代码中也存在问题:动态生成的SQL语句对SQL interjection攻击是开放的.您需要重新编写查询以使用查询参数.这将解决引号的问题,并使您的SQL更加健壮.

以下是如何修改update使用参数的简短示例:

Imports System.Data.SqlClient
Public Class Example
    Private Sub Update(ByVal userName As System.String, _
            ByVal email As System.String)
        Dim con As SqlConnection = New SqlConnection( _
            "Data Source=.;Integrated Security=True;<...>")
        con.Open()
        Dim cmdText As String = _
            "UPDATE faqtbl SET Name=@UserName,Email=@email"
        Dim cmd As SqlCommand = New SqlCommand(cmdText, con)
        With cmd.Parameters
            .Add(New SqlParameter("@UserName", userName))
            .Add(New SqlParameter("@email", email))
        End With
        cmd.ExecuteNonQuery()
        con.Close()
        con = Nothing
    End Sub
End Class