如何在SQL Server 2005中纠正此查询

时间:2009-10-07 06:00:59

标签: sql sql-server sql-server-2005 tsql

我有一个查询,它是两个查询的联合,结果查询返回重复记录,我不想要重复记录。我尝试使用DISTINCT但仍然得到相同的结果,有人可以帮我修复此查询吗?

我也想知道这个查询是否对SQL注入是安全的......我将在下面粘贴我的查询:

ALTER PROCEDURE [dbo].[sp_GetTrashListWithSorting] --'6dbf9a01-c88f-414d-8dd9-696749258cef', '6dbf9a01-c88f-414d-8dd9-696749258cef','DateTime ASC','0','30'
(
    @p_CreatedBy UNIQUEIDENTIFIER,
    @p_ToReceipientID UNIQUEIDENTIFIER,
    @p_SortExpression NVARCHAR(100),
    @p_StartIndex INT,
    @p_MaxRows INT
)
AS
    SET NOCOUNT ON;

    IF LEN(@p_SortExpression) = 0 
       SET @p_SortExpression ='DateTime DESC'

    DECLARE @Sql NVARCHAR(4000)

    SET @sql = 'SELECT ID, DateTime, Subject, CreatedBy, ToReceipientID, Status
                FROM (SELECT ID, 
                             DateTime, 
                             Subject, 
                             CreatedBy, 
                             ToReceipientID, 
                             Status,
                             ROW_NUMBER() OVER(ORDER BY '+ @p_SortExpression +') AS Indexing
                      FROM (SELECT ID,
                                   DateTime, 
                                   Subject, 
                                   CreatedBy, 
                                   ToReceipientID, 
                                   SenderStatus AS Status
                             FROM ComposeMail 
                             WHERE (CreatedBy = @p)
                               AND (SenderStatus = 7 OR SenderStatus = 8)
                             UNION
                             SELECT ID,
                                    DateTime, 
                                    Subject, 
                                    CreatedBy, 
                                    ToReceipientID, 
                                    ReceiverStatus As Status
                              FROM ComposeMail
                              WHERE (ToReceipientID = @p1) 
                                AND (ReceiverStatus = 7 OR ReceiverStatus = 8)) AS NewDataTable
            ) AS IndexTable
   WHERE 
       Indexing > @p2 AND Indexing<= (@p2+@p3)' 

   DECLARE @paramDefinition NVARCHAR(500)

   SET @paramDefinition = N'@p UNIQUEIDENTIFIER ,@p1 UNIQUEIDENTIFIER, @p2 INT, @p3 INT'

   EXEC sp_executesql @sql, @paramDefinition,
                @p = @p_CreatedBy,
                @p1 = @p_ToReceipientID,
                @p2 = @p_StartIndex ,
                @p3 = @p_MaxRows

2 个答案:

答案 0 :(得分:3)

1)我将你的SQL重写为:

WITH trash_list AS (
SELECT cm.id,
       cm.datetime, 
       cm.subject,
       cm.createdby,
       cm.toreceipientid, 
       cm.senderstatus AS Status
  FROM COMPOSEMAIL cm
 WHERE cm.createdBy = @p
   AND cm.enderStatus IN(7, 8)
UNION
SELECT cm.id,
       cm.datetime, 
       cm.subject,
       cm.createdby,
       cm.toreceipientid, 
       cm.receiverstatus AS Status
  FROM COMPOSEMAIL cm
 WHERE cm.toreceipientid = @p1
   AND cm.receiverstatus IN (7, 8))
SELECT t.id,
       t.datetime, 
       t.subject,
       t.createdby,
       t.toreceipientid, 
       t.status
  FROM (SELECT tl.id,
               tl.datetime, 
               tl.subject,
               tl.createdby,
               tl.toreceipientid, 
               tl.status,
               ROW_NUMBER() OVER(ORDER BY '+ @p_SortExpression +') AS Indexing
          FROM trash_list tl
      GROUP BY tl.id,
               tl.datetime, 
               tl.subject,
               tl.createdby,
               tl.toreceipientid, 
               tl.status) t
 WHERE t.indexing BETWEEN @p2 AND (@p2+@p3)

...但如果仍然有重复项,请查看WITH子句中SELECT / UNION中的逻辑。

在将其转换为动态SQL之前,将其作为普通SQL工作。

2)查询对注入攻击不安全,因为当用户可以提供文本时,您不处理单引号:

IF LEN(@p_SortExpression)=0 
  SET @p_SortExpression ='DateTime DESC'

......应该是:

IF LEN(@p_SortExpression)=0 
  SET @p_SortExpression ='DateTime DESC'
ELSE
  SET @p_SortExpression = REPLACE(@p_SortExpression, '''', '''''')

答案 1 :(得分:0)

您不需要查询和联合。而不是这两行(每个子查询一个)

                         WHERE (CreatedBy = @p)
                         WHERE (ToReceipientID = @p1) 

执行此操作(在一个查询中)

                         WHERE CreatedBy IN (@p, @p1)

像这样:

SELECT
      ID
    , DateTime
    , Subject
    , CreatedBy
    , ToReceipientID
    , Status
FROM (
      SELECT
            ID
          , DateTime
          , Subject
          , CreatedBy
          , ToReceipientID
          , SenderStatus AS Status
          , ROW_NUMBER() OVER (ORDER BY ' + @p_SortExpression + ') AS Indexing
      FROM ComposeMail
      WHERE CreatedBy IN (@p, @p1)
            AND (SenderStatus = 7
            OR SenderStatus = 8)
) AS IndexTable
WHERE Indexing > @p2
      AND Indexing <= (@p2 + @p3)

但是我不确定我是否理解你如何传递@p或@ p1

的值