Question

我正在尝试通过我的程序登录我们的数据库，但是当我这样做时，我获得了无效的凭据，所以我不知道从哪里开始希望有人可以帮助我，因为我没有与pwdencryp和pwdcompare合作以前，我不知道该怎么办才能让它发挥作用

我的代码：

       protected String doInBackground(String... params) {
            if (userid.trim().equals("Developer")|| password.trim().equals("Dev!n_234"))
                isSuccess2=true;
            z = getString(R.string.login_succes);
            if(userid.trim().equals("")|| password.trim().equals(""))
                z = getString(R.string.indsæt_rigtigt_bruger);
            else
            {
                try {
                    Connection con = connectionClass.CONN();
                    if (con == null) {
                        z = getString(R.string.Forbindelses_fejl)+"L1)";

                    } else {
                        CallableStatement cs = null;
                        String query = "{call [system].[usp_validateUserLogin] (?,?,?,?,?)}";
                        Statement stmt = con.createStatement();
                        ResultSet rs = stmt.executeQuery(query);
                        CallableStatement ps = con.prepareCall(query);
                        ps.setString(1, userid);
                        ps.setString(2, password);
                        ps.setInt(3,72);
                        ps.setNull(4, Types.BOOLEAN);
                        ps.registerOutParameter(5, Types.VARCHAR);
                        cs.executeUpdate();
                        if(rs.next())
                        {

                            z = getString(R.string.login_succes);

                            isSuccess=true;
                        }
                        else
                        {
                            z = getString(R.string.Invalid_Credentials);
                            isSuccess = false;
                        }

                    }
                }
                catch (Exception ex)
                {
                    isSuccess = false;
                    z = getString(R.string.Exceptions)+"L2)";
                    Log.e("MYAPP", "exception", ex);
                }
            }
            return z;

        }
    }


}

} 程序

ALTER PROCEDURE [system].[usp_validateUserLogin]
    @p_Login NVARCHAR ( 50 )
    , @p_Password NVARCHAR ( 32 )
    , @p_CompanyID INT
    , @p_OutDetails BIT = 1
    , @p_AuthenticationTicket VARCHAR(200) OUTPUT
AS
BEGIN
    SET NOCOUNT ON;

    DECLARE @errNo INT
        , @recCount INT
        , @res INT

    SELECT u.*
        INTO #tmpLogin
    FROM system.[User] AS u WITH ( NOLOCK )
    WHERE ( u.Login = @p_Login )
        AND ( u.Company_ID = @p_CompanyID )
        AND ( pwdcompare ( @p_Password, u.Passwd ) = 1 )
        AND ( u.Status = 0 ) --Active

    SELECT @errNo = @@ERROR
        , @recCount = @@ROWCOUNT

    IF ( @errNo <> 0 )
    BEGIN
        RETURN 1010
    END

    IF ( @recCount = 1 )
    BEGIN
        DECLARE @userID INT
        SELECT @userID = ID
        FROM #tmpLogin

        EXEC @res = system.usp_renewAuthenticationTicket @p_DoerTicket = ''
                                                        , @p_AuthenticationTicket = @p_AuthenticationTicket OUTPUT
                                                        , @p_UserID = @userID
                                                        , @p_CompanyID = @p_CompanyID
        IF ( @res <> 0 )
            RETURN @res

    END
    --SET @p_AuthenticationTicket = 'TESTAUTHENTICATIONTICKET0123456789'

    IF ( @p_OutDetails = 1 )
    BEGIN
        SELECT *
        FROM #tmpLogin
    END

    RETURN 0
END

以下是用户注册的程序

ALTER PROCEDURE [system].[usp_iudUser]
    @p_ID INT = NULL OUTPUT
    , @p_Login NVARCHAR ( 50 ) = NULL
    , @p_Password NVARCHAR ( 32 ) = NULL
    , @p_FullName NVARCHAR ( 100 ) = NULL
    --, @p_LastName NVARCHAR ( 50 ) = NULL
    , @p_EMail NVARCHAR ( 200 ) = NULL
    , @p_Status TINYINT = NULL
    , @p_Roles VARCHAR ( 200 ) = NULL
    , @p_DoerTicket VARCHAR ( 200 )
AS
BEGIN
    SET NOCOUNT ON;

    DECLARE @doerUserID INT
            , @doerCompanyID INT
    EXEC system.usp_validateAuthenticationTicket @p_Ticket = @p_DoerTicket
                                                , @p_UserID = @doerUserID OUTPUT
                                                , @p_CompanyID = @doerCompanyID OUTPUT


    MERGE INTO system.[User] AS target
    USING ( SELECT @p_ID
                , @doerCompanyID
                , @p_Login
                , @p_Password
                , @p_FullName
                , @p_Roles
                , @p_Status
                /*, @p_FirstName
                , @p_LastName*/
                , @p_EMail ) AS source ( ID
                                        , CompanyID
                                        , Login
                                        , Password
                                        , FullName
                                        , Roles
                                        , Status
                                        /*, FirstName
                                        , LastName*/
                                        , EMail )
    ON ( target.ID = source.ID )
        AND ( target.Company_ID = source.CompanyID )
    WHEN MATCHED THEN
        UPDATE SET 
            target.Login = CASE WHEN source.Status = 200 THEN target.Login + '_' + CAST ( source.ID AS VARCHAR ( 10 ) ) ELSE target.Login END --Login can not be changed
            , target.Passwd = ISNULL ( pwdencrypt ( source.Password ), target.Passwd )
            , target.FullName = ISNULL ( source.FullName, target.FullName )
            --, target.LastName = ISNULL ( source.LastName, target.LastName )
            , target.EMail = ISNULL ( source.EMail, target.EMail )
            , target.Roles = ISNULL ( source.Roles, target.Roles )
            , target.Status = ISNULL ( source.Status, target.Status )
    WHEN NOT MATCHED BY TARGET AND source.ID IS NULL THEN
        INSERT ( Company_ID
                , Login
                , Passwd
                , FullName
                , Roles
                , Status
                /*, FirstName
                , LastName*/
                , EMail )
            VALUES ( source.CompanyID
                    , source.Login
                    , pwdencrypt ( source.Password )
                    , source.FullName
                    , NULLIF ( RTRIM ( source.Roles ), '' )
                    , ISNULL ( source.Status, 0 )
                    /*, source.FirstName
                    , source.LastName*/
                    , NULLIF ( source.EMail, '' ) );

    IF ( @@ROWCOUNT <> 1 )
    BEGIN
        RETURN 1010
    END

    IF ( @p_Id IS NULL )
        SET @p_Id = SCOPE_IDENTITY ( )

    RETURN 0    
END

Answer 1

在proc [usp_validateUserLogin]中，您使用参数@p_OutDetails来确定是否将数据返回给调用者，并且在调用者中使用记录已返回的事实来确定该过程是否成功。

第ps.setString(4, null);行将[usp_validateUserLogin]中参数@p_OutDetails的值设置为null。这与不提供参数完全不同，因为SQL Server将使用值NULL而不是默认值。如果未提供参数，则它将使用默认值（1）。另外，期望的参数类型是BIT，因此应该使用类似ps.SetBoolean的东西将BIT参数的值设置为显式值1（或true）。

作为显示使用默认值而不是提供NULL值的示例：

CREATE PROCEDURE TestProc
    @MyString   VARCHAR(10) = 'string'

AS
BEGIN
    SET NOCOUNT ON
    SELECT @MyString AS Param, ISNULL(@MyString, 'Was Null') AS ItsValue
END
GO


EXEC TestProc null
EXEC TestProc 'A Value'
EXEC TestProc   --no params at all

运行此proc会返回以下3种类型的EXEC。

Param,ItsValue
NULL,Was Null

Param,ItsValue
A Value,A Value

Param,ItsValue
string,string

您的代码执行第一种方式，因此当它执行以下行时，@ p_OutDetails包含NULL并跳过此位。

IF ( @p_OutDetails = 1 )
BEGIN
    SELECT *
    FROM #tmpLogin
END

使用pwdencrypt时从哪里开始登录？

1 个答案: