ASP.NET C#参数化查询返回任何内容

Question

好的,我是参数化查询的菜鸟.我理解为什么你应该使用它们,但除了我找不到任何显示正确方法的资源或至少一个显示实际工作方式的资源.

所以我的问题是关于我的代码是否正确.它编译并运行得很好,但它在gridview中完全没有返回.

 protected void SearchButton_Click(object sender, EventArgs e)
{
    string searchBoxValue = SearchBox.Text;
    string columnNameValue = ColumnName.SelectedValue;
    columnNameValue.ToLower();

    SqlCommand searchCommand = new SqlCommand();
    searchCommand.Connection = connection;
    searchCommand.CommandText = "select firstname AS FirstName,lastname AS LastName, zipcode as ZipCode, phone AS Phone, email AS Email, cancersurvivor AS CancerSurvivor, ethnicity AS Ethnicity from registrants where @columnname = @searchterm";

    SqlParameter columnParam = new SqlParameter();
    columnParam.ParameterName = "@columnname";
    columnParam.Value = columnNameValue;

    SqlParameter searchBoxParam = new SqlParameter();
    searchBoxParam.ParameterName = "@searchterm";
    searchBoxParam.Value = searchBoxValue;

    searchCommand.Parameters.Add(columnParam);
    searchCommand.Parameters.Add(searchBoxParam);

    UpdateTable(searchCommand);

}

UpdateTable函数接受SqlCommand对象,然后使用DataAdapter对象执行命令并填充DataTable对象,然后将gridview数据源设置为datatable对象并绑定它.

就像我之前说的那样,我真的在寻找合适的方法吗？我需要一个存储过程才能执行此操作吗？我对这一切感到困惑,为什么它不起作用.

Answer 1

你不能参数化@columnname.这需要是您查询中的文字.

你的陈述

select 
 /* .... */
from registrants where @columnname = @searchterm

registrants如果参数的值恰好相同或没有行,则返回所有行.

它不会查看并查看您是否有该名称的列,并查看其中是否@searchterm存在该列.

要以安全的方式执行此操作,您需要检查是否columnNameValue匹配有效列名称的白名单之一(因为您必须知道该表中可能的列名称)并将其连接到您的查询中.不要连接未经验证的用户输入.然后你打开自己的SQL注入.

所以你可能会实现类似的东西

using System.Linq;

protected void SearchButton_Click(object sender, EventArgs e)
{
    string columnNameValue = ColumnName.SelectedValue.ToLower();

    var validColumnNames = new string[] { "firstname", "lastname", "zipcode" };

    if (!validColumnNames.Contains(columnNameValue))
    {
        throw new Exception("Unexpected column name " + columnNameValue);
    }

    /* ... code omitted */

    searchCommand.CommandText = "select firstname AS FirstName,lastname AS LastName, zipcode as ZipCode, phone AS Phone, email AS Email, cancersurvivor AS CancerSurvivor, ethnicity AS Ethnicity from registrants where " + columnNameValue + " = @searchterm";

    /* ... code omitted */
}