我已经在下面发布了我的代码，用于Excel导出类（无论如何都是这样）。我所引发的问题是，这种出口在注射攻击方面并不安全。我很容易用参数掩盖初始命令，但是，当我将参数化命令传递给Export（string）方法时，它会丢失先前在参数中设置的值;它只传递文字字符串（即SELECT * FROM TABLE WHERE COLUMN_NAME = @ Parameter1）。 我想弄清楚的是一种防止此代码不安全的方法。我真的需要这个功能。过去一切都很好，因为应用程序需要受众，但我不能使用这个特定的代码，因为它将面向客户，更不公开使用。 ：/ 有关如何实现这一目标的任何建议吗？
public static void Export(string CrossoverStatement = "SELECT * FROM TABLE")
{
// @@Parameters
//
// CrossoverStatement string :
// This is the string representation of the procedure executed to obtain the desired crossover query results.
//Create our database connection as well as the excel reference and workbook/worksheet we are using to export the data
string ODBCConnection = "SERVER INFO";
Application xls = new Application();
xls.SheetsInNewWorkbook = 1;
// Create our new excel application and add our workbooks/worksheets
Workbook Workbook = xls.Workbooks.Add();
Worksheet CrossoverPartsWorksheet = xls.Worksheets[1];
// Hide our excel object if it's visible.
xls.Visible = false;
// Turn off screen updating so our export will process more quickly.
xls.ScreenUpdating = false;
CrossoverPartsWorksheet.Name = "Crossover";
if (CrossoverStatement != string.Empty)
{
CrossoverPartsWorksheet.Select();
var xlsheet = CrossoverPartsWorksheet.ListObjects.AddEx(SourceType: XlListObjectSourceType.xlSrcExternal,
Source: ODBCConnection,
Destination: xls.Range["$A$1"]).QueryTable;
xlsheet.CommandText = CrossoverStatement;
xlsheet.RowNumbers = false;
xlsheet.FillAdjacentFormulas = false;
xlsheet.PreserveColumnInfo = true;
xlsheet.PreserveFormatting = true;
xlsheet.RefreshOnFileOpen = false;
xlsheet.BackgroundQuery = false;
xlsheet.SavePassword = false;
xlsheet.AdjustColumnWidth = true;
xlsheet.RefreshPeriod = 0;
xlsheet.RefreshStyle = XlCellInsertionMode.xlInsertEntireRows;
xlsheet.Refresh(false);
xlsheet.ListObject.ShowAutoFilter = false;
xlsheet.ListObject.TableStyle = "TableStyleMedium16";
// Unlink our table from the server and convert to a range.
xlsheet.ListObject.Unlink();
// Freeze our column headers.
xls.Application.Rows["2:2"].Select();
xls.ActiveWindow.FreezePanes = true;
xls.ActiveWindow.DisplayGridlines = false;
// Autofit our rows and columns.
xls.Application.Cells.EntireColumn.AutoFit();
xls.Application.Cells.EntireRow.AutoFit();
// Select the first cell in the worksheet.
xls.Application.Range["$A$2"].Select();
// Turn off alerts to prevent asking for 'overwrite existing' and 'save changes' messages.
xls.DisplayAlerts = false;
}
// Make our excel application visible
xls.Visible = true;
// Release our resources.
Marshal.ReleaseComObject(Workbook);
Marshal.ReleaseComObject(CrossoverPartsWorksheet);
Marshal.ReleaseComObject(xls);
}
答案 0 :(得分：0)
这是完成此请求的最佳方式，我可以提出。执行参数化查询并将结果数据传递给表，您可以在调用Export（datatable）时使用该表。
问题解决了。
public static void Export(System.Data.DataTable CrossoverDataTable)
{
// @@Parameters
//
// CrossoverDataTable DataTable :
// This is a data table containing information to be exported to our excel application.
// Requested as a way to circumvent sql injection opposed to the initial overload accepting only a string .commandtext.
Application xls = new Application();
xls.SheetsInNewWorkbook = 1;
// Create our new excel application and add our workbooks/worksheets
Workbook Workbook = xls.Workbooks.Add();
Worksheet CrossoverPartsWorksheet = xls.Worksheets[1];
// Hide our excel object if it's visible.
xls.Visible = false;
// Turn off screen updating so our export will process more quickly.
xls.ScreenUpdating = false;
// Turn off calculations if set to automatic; this can help prevent memory leaks.
xls.Calculation = xls.Calculation == XlCalculation.xlCalculationAutomatic ? XlCalculation.xlCalculationManual : XlCalculation.xlCalculationManual;
// Create an excel table and fill it will our query table.
CrossoverPartsWorksheet.Name = "Crossover Data";
CrossoverPartsWorksheet.Select();
{
// Create a row with our column headers.
for (int column = 0; column < CrossoverDataTable.Columns.Count; column++)
{
CrossoverPartsWorksheet.Cells[1, column + 1] = CrossoverDataTable.Columns[column].ColumnName;
}
// Export our datatable information to excel.
for (int row = 0; row < CrossoverDataTable.Rows.Count; row++)
{
for (int column = 0; column < CrossoverDataTable.Columns.Count; column++)
{
CrossoverPartsWorksheet.Cells[row + 2, column + 1] = (CrossoverDataTable.Rows[row][column].ToString());
}
}
}
// Freeze our column headers.
xls.Application.Rows["2:2"].Select();
xls.ActiveWindow.FreezePanes = true;
xls.ActiveWindow.DisplayGridlines = false;
// Autofit our rows and columns.
xls.Application.Cells.EntireColumn.AutoFit();
xls.Application.Cells.EntireRow.AutoFit();
// Select the first cell in the worksheet.
xls.Application.Range["$A$2"].Select();
// Turn off alerts to prevent asking for 'overwrite existing' and 'save changes' messages.
xls.DisplayAlerts = false;
// ******************************************************************************************************************
// This section is commented out for now but can be enabled later to have excel sheets show on screen after creation.
// ******************************************************************************************************************
// Make our excel application visible
xls.Visible = true;
// Turn screen updating back on
xls.ScreenUpdating = true;
// Turn automatic calulation back on
xls.Calculation = XlCalculation.xlCalculationAutomatic;
// Release our resources.
Marshal.ReleaseComObject(Workbook);
Marshal.ReleaseComObject(CrossoverPartsWorksheet);
Marshal.ReleaseComObject(xls);
}