asp.net connection issues_问答_开发者_运维开发者技术经验分享

开发者 https://www.devze.com 2023-03-29 08:45 出处：网络

This is my ASP.NET code: <html> <body> <% Dim Conn Conn = \"Provider=xxxxxx; Server=xxxxxx; Database=xxxxxx; Trusted_Connection=xxx; \"

相关专题：asp.net

This is my ASP.NET code:

<html>
<body>

<%
Dim Conn
Conn = "Provider=xxxxxx; Server=xxxxxx; Database=xxxxxx; Trusted_Connection=xxx; "


sql="INSERT IN开发者_Python百科TO xxxx"
sql=sql & " VALUES "
sql=sql & "('" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "',"
sql=sql & "'" & Request.Form("xxxx") & "')"

on error resume next
Conn.Execute sql,recaffected
if err<>0 then
  Response.Write("Update Failed")
else
  Response.Write("<h3>"Record Added</h3>")
end if

%>

</body>
</html>

I always get a result of "Update Failed"... Can you see from the code why this is?

Suggest a major refactoring to eliminate your SQL injection vulnerability.

Dim  conn As New SqlConnection(SomeConnectionString)
Dim  cmd As SqlCommand = conn.CreateCommand()

conn.Open()
cmd.CommandText="INSERT INTO MyTable(Column1, Column2)  " & _
                     " VALUES (@Value1, @Value2)"
cmd.Parameters.AddWithValue("@Value1", Request.Form("xxxx"))
cmd.Parameters.AddWithValue("@Value2", Request.Form("xxxx"))
'add all your parameters as per above  '

cmd.ExecuteNonQuery()

You need to take out the command text and use procedures, otherwise you open yourself to security holes. NEVER put your SQL commands on your UI or code-behind. Best practices is stored procedures.