[]
[我要回覆]
1
|
|||||
|
|||||
樓主 MStone Lin 
 發送站內信 |
我要防sql injection textbox1 id: idd.text textbox2 id: pww.text 但id 部份有作判斷及like 直接寫法是... where cardno like 'sh%"& right("0"+idd.text,4) &"' and .... 改用 cmd.Parameters 寫法 一直試不出來 請問應該怎麼寫 <code> Dim sqlstr As String Dim datee As String = Year(Now) - 1911 & Right("0" & Month(Now), 2) & Right("0" & Day(Now), 2) Dim conn As New SqlConnection(WebConfigurationManager.ConnectionStrings("123ConnectionString").ConnectionString.ToString()) conn.Open() sqlstr = "select * from password where cardno like @id1+'%'+@id2 and password =@pw Collate Chinese_Taiwan_Stroke_CS_AS and date1='' " ' sqlstr = "select * from password where cardno =@id and password =@pw Collate Chinese_Taiwan_Stroke_CS_AS and (date1='' or date1 >='" & datee & "') " Dim dr As SqlDataReader = Nothing Dim cmd As SqlCommand = New SqlCommand(sqlstr, conn) cmd.Parameters.AddWithValue("@id1", "sh") cmd.Parameters.AddWithValue("@id2", Right("0" + idd.Text, 4)) cmd.Parameters.AddWithValue("@id", idd.Text) cmd.Parameters.AddWithValue("@pw", pww.Text) Try dr = cmd.ExecuteReader '檢查password If dr.Read Then Response.Redirect("default.aspx") Else ScriptManager.RegisterClientScriptBlock(UpdatePanel1, Me.[GetType](), "script", "alert('帳密有誤');", True) End If Catch ex As Exception Finally cmd.Cancel() dr.Close() conn.Close() conn.Dispose() End Try </code> |
||||
0
99
1962
132
| 1樓 |
錯誤訊息是什麼?
本篇文章回覆於2018-08-16 12:20
== 簽名檔 ==
--未登入的會員無法查看對方簽名檔-- |
| 2樓
作者回應
MStone Lin
|
從If dr.Read Then 直接跳到else ..
查無資料
本篇文章回覆於2018-08-16 13:43
== 簽名檔 ==
--未登入的會員無法查看對方簽名檔-- |
| 3樓 |
你把 cardno 要 Like 的資料直接寫成一個字串試試看...
本篇文章回覆於2018-08-16 19:32
== 簽名檔 ==
--未登入的會員無法查看對方簽名檔-- |
| 4樓
作者回應
MStone Lin
|
回小魚
改如下 sqlstr = "select * from password where cardno like @id1 and password =@pw Collate Chinese_Taiwan_Stroke_CS_AS and date1='' " cmd.Parameters.AddWithValue("@id1", "cs%" + Right("0" + idd.Text, 4)) 還是不行 Parameters不接受"%" 所以一開始試的方法 才加入外面 @id+"%"
本篇文章回覆於2018-08-17 12:01
== 簽名檔 ==
--未登入的會員無法查看對方簽名檔-- |
| 5樓 |
我這邊沒資料也沒辦法測試,
不過參數是可以帶%的, 你再確認看看可能是其他原因吧.
本篇文章回覆於2018-08-17 12:46
== 簽名檔 ==
--未登入的會員無法查看對方簽名檔-- |
| 6樓
作者回應
MStone Lin
|
我用SqlDataSource 元件來試
<asp:SqlDataSource ID="SqlDataSource1" runat="server" ConnectionString="<%$ ConnectionStrings:123dataConnectionString %>" SelectCommand="select * from password where cardno like @id and password =@pw Collate Chinese_Taiwan_Stroke_CS_AS and date1=''"> <SelectParameters> <asp:ControlParameter ControlID="Label3" DefaultValue="sh%0813" Name="id" PropertyName="Text" /> <asp:ControlParameter ControlID="pww" DefaultValue="" Name="pw" PropertyName="Text" /> </SelectParameters> </asp:SqlDataSource> 也是不行....@@
本篇文章回覆於2018-08-17 14:12
== 簽名檔 ==
--未登入的會員無法查看對方簽名檔-- |
1
| 回覆 |
| 如要回應,請先登入. |
