Question

我有一个不安全的查询，该查询允许进行注入，并且我不确定如何对其进行参数化以防止进行注入

Dim sInsertSQL As String
sInsertSQL = "Insert into tbl_userprop (Prop_Def) values "

        Dim tempString As String() = PropertyDefinitions.Split("|")
        For i As Integer = 1 To tempString.Length

            If tempString(i - 1).Length > 0 Then
                sInsertSQL = sInsertSQL + " ('" + tempString(i - 1) + "'),"
                bInsert = True
            End If

        Next

tempString中最多存储10个值，它们按以下方式串联到sInsertSQL上：（'val1'），（'val2'）等

弄清楚了，为好奇而更新：

        Dim lstParams As New Collections.Generic.List(Of SqlParameter)
        Dim tempString As String() = PropertyDefinitions.Split("|")
        For i As Integer = 1 To tempString.Length

            If tempString(i - 1).Length > 0 Then
                Dim sParamName As String = String.Format("@param{0}", i)
                Dim sparam As New SqlParameter(sParamName, tempString(i - 1))
                lstParams.Add(sparam)
                sInsertSQL = sInsertSQL + " (" + sParamName + "),"
                bInsert = True
            End If

        Next

Answer 1

分割字符串后，您将知道将有多少个参数，因此可以为SQL创建@项目。之后，您可以通过遍历参数名称和值的列表来添加参数：

Dim PropertyDefinitions = "abc|def|ghi|jkl|mno"
Dim values = PropertyDefinitions.Split({"|"c})

Dim paramNames = Enumerable.Range(0, values.Count()).Select(Function(n) $"@p{n}")
Dim paramList = String.Join(", ", paramNames.Select(Function(s) $"({s})"))

Dim sql = "INSERT INTO [tbl_userprop] (Prop_Def) VALUES " & paramList
' The following line with the sample data would output '
' INSERT INTO [tbl_userprop] (Prop_Def) VALUES (@p0), (@p1), (@p2), (@p3), (@p4)
'Console.WriteLine(sql)


Dim connStr = "YourConnectionStringHere"

Using conn As New SqlConnection(connStr)
    Using cmd As New SqlCommand(sql, conn)
        For i = 0 To values.Count() - 1
            'TODO: Set the .SqlDbType and .Size to conform to the database definition of [tbl_userprop]. '
            cmd.Parameters.Add(New SqlParameter With {.ParameterName = paramNames(i),
                                                      .Value = values(i),
                                                      .SqlDbType = SqlDbType.NVarChar,
                                                      .Size = 99})
        Next

        'conn.Open()
        'cmd.ExecuteNonQuery()

    End Using

End Using

参数化动态SQL查询（VB.Net）

1 个答案: