SQL搜索加密值不起作用

Question

我正在使用按钮触发SELECT语句，并根据用户在2个文本框（SearchFirstTxt，SearchLastTxt）中输入的条件，发送文本值这些文本框通过加密类来查找它们的匹配 我将其返回SqlDataAdapter并使用它填充DataTable。然后，我使用DataGridView.DataSoruce = dt将其添加到DGV。

我的问题：如果用户将两个文本框都留空并单击“SearchBtn”，则不会选择所有记录。它实际上只选择具有相同加密值的记录。

以下是代码：

    eFirst = clsEncrypt.EncryptData(SearchFirstTxt.Text.Trim.ToUpper)
    eLast = clsEncrypt.EncryptData(SearchLastTxt.Text.Trim.ToUpper)

    conn.Open()
    cmd.Connection = conn

    If SearchFirstTxt.Text = "" Then
        cmd.CommandText = "Select * FROM Participant Where LAST_NM_TXT = '" & eLast & "' ; "
    ElseIf SearchLastTxt.Text = "" Then
        cmd.CommandText = "Select * FROM Participant WHERE FIRST_NM_TXT = '" & eFirst & "' ; "
    Else
        cmd.CommandText = "SELECT * FROM PARTICIPANT;"
    End If

    Dim adapter As New SqlDataAdapter(cmd)
    adapter.Fill(dt)

    DataGridView1.DataSource = dt

    Try
        For i As Integer = 0 To dt.Rows.Count - 1
            dt.Rows(i)("FIRST_NM_TXT") = clsEncrypt.DecryptData(eFirst)
            dt.Rows(i)("LAST_NM_TXT") = clsEncrypt.DecryptData(eLast)
        Next
    Catch ex As Exception
        MessageBox.Show("Error")
    Finally
        conn.Close()
    End Try

如何从Participant dbo中选择所有记录？

如果文本框留空，结果集如下所示：

编辑：我切换了我的代码，它会检索所有结果，但是，现在我很难返回它们。 （它们以加密方式返回，但未解密）

以下是更改：

        If SearchFirstTxt.Text = "" And SearchLastTxt.Text = "" Then
        cmd.CommandText = "SELECT * FROM PARTICIPANT;"
    ElseIf SearchLastTxt.Text = "" Then
        cmd.CommandText = "Select * FROM Participant WHERE FIRST_NM_TXT = '" & eFirst & "' ; "
    ElseIf SearchFirstTxt.Text = "" Then
        cmd.CommandText = "Select * FROM Participant Where LAST_NM_TXT = '" & eLast & "' ; "
    End If

Answer 1

如果我正确理解您的要求，则在尝试搜索加密数据时需要添加对其他搜索文本的检查

If SearchFirstTxt.Text = "" AndAlso SearchLastTxt.Text <> "" Then
    ' Search the last only if you have a last and not a first'
    cmd.CommandText = "Select * FROM Participant Where LAST_NM_TXT = @searchLast"
    cmd.Parameters.AddWithValue("@searchLast", eLast)

ElseIf SearchLastTxt.Text = "" AndAlso SearchFirstTxt.Text <> "" Then
    ' Search the first only if you have a first and not a last'
    cmd.CommandText = "Select * FROM Participant WHERE FIRST_NM_TXT = @searchFirst"
    cmd.Parameters.AddWithValue("@searchFirst", eFirst)

ElseIf SearchFirstTxt.Text = "" AndAlso SearchLastText.Text = "" Then
    ' Both emtpy so search everything'
    cmd.CommandText = "SELECT * FROM PARTICIPANT;"

Else
    ' Both filled so search exactly (not sure if this is needed)'
    cmd.CommandText = "Select * FROM Participant " & _
                      "WHERE FIRST_NM_TXT = @searchFirst " & _
                      "OR LAST_NM_TXT = @searchLast"
    cmd.Parameters.AddWithValue("@searchFirst", eFirst)
    cmd.Parameters.AddWithValue("@searchLast", eLast)
End If

Dim adapter As New SqlDataAdapter(cmd)
adapter.Fill(dt)

请注意，我已删除了字符串连接并使用了参数化查询。它更安全（避免Sql Injection）并删除解析问题（如果加密文本包含单引号怎么办？）

假设您要显示解密数据，将deCryptData函数应用于数据表中的值，而不是显示用于搜索的相同值（您已经知道明文）

Try
    For i As Integer = 0 To dt.Rows.Count - 1
        dt.Rows(i)("FIRST_NM_TXT") = clsEncrypt.DecryptData(dt.Rows(i)("FIRST_NM_TXT").ToString)
        dt.Rows(i)("LAST_NM_TXT") = clsEncrypt.DecryptData(dt.Rows(i)("LAST_NM_TXT").ToString)
    Next
Catch ex As Exception
    MessageBox.Show("Error")
Finally
    conn.Close()
End Try