幫助與asp登錄SQL

Question

我有一個表單提交時轉到以下登錄腳本。

<% 
    Dim myConnection As System.Data.SqlClient.SqlConnection 
    Dim myCommand As System.Data.SqlClient.SqlCommand 
    Dim requestName As String 
    Dim requestPass As String 
    requestName = Request.Form("userName") 
    requestPass = Request.Form("userPass") 
    Dim queryString As String = "SELECT COUNT(*) AS Num_Of_User FROM tblusers WHERE username='" & requestName & "' AND password='" & requestPass & "'" 
    myConnection = New System.Data.SqlClient.SqlConnection("Data Source=(local);InitialCatalog=dbtest;Integrated Security=True") 
    myCommand = New System.Data.SqlClient.SqlCommand(queryString, myConnection) 
    myConnection.Open() 
    Dim reader As System.Data.SqlClient.SqlDataReader = myCommand.ExecuteReader() 
%> 

現在，在理論上，我應該能夠得到的SQL查詢Num_Of_User，比登錄成功，如果它等於1。這是正確的方法嗎？我怎樣才能得到SQL返回的值？

Answer 1

嘗試myCommand.ExecuteScalar()，它返回結果集第一行第一列的值 - 正是您在此處的值。

此外，檢查ASP.Net'內置'認證方法 - 這可能會節省您一些努力。

Answer 2

您可以使用該代碼進行SQL注入。

看到，如果你輸入用戶名作爲' OR 2>1--

您需要更改使用參數化查詢情況。

Dim queryString As String = "SELECT COUNT(*) AS Num_Of_User FROM tblusers WHERE username=@username AND password=@password" 
myConnection = New System.Data.SqlClient.SqlConnection("Data Source=(local);InitialCatalog=dbtest;Integrated Security=True") 
myCommand = New System.Data.SqlClient.SqlCommand(queryString, myConnection) 
myCommand.Parameters.AddWithValue("@username", requestName) 
myCommand.Parameters.AddWithValue("@password", requestPass) 

你也不能處理可能拋出的任何異常，也沒有處置你的對象。

您的代碼應該看起來更像下面的代碼。

Dim numUsers as Integer 
Using myConnection as New System.Data.SqlClient.SqlConnection("Data Source=(local);InitialCatalog=dbtest;Integrated Security=True") 
    Dim queryString As String = "SELECT COUNT(*) AS Num_Of_User FROM tblusers WHERE username=@username AND password=@password" 
    Using myCommand as New System.Data.SqlClient.SqlCommand(queryString, myConnection) 
     myConnection.Open 
     myCommand.Parameters.AddWithValue("@username", requestName) 
     myCommand.Parameters.AddWithValue("@password", requestPass) 
     numUsers = myCommand.ExecuteScalar() 
    End Using 
End Using 

上面的代碼將確保您的對象被處置，但不會處理可能拋出的任何異常。