Ò׽ؽØÍ¼Èí¼þ¡¢µ¥Îļþ¡¢Ãâ°²×°¡¢´¿ÂÌÉ«¡¢½ö160KB

ASP.NETÖÐÈçºÎ·À·¶SQL×¢Èëʽ¹¥»÷

1½«sqlÖÐʹÓõÄÒ»Ð©ÌØÊâ·ûºÅ£¬Èç' -- /* ; %µÈÓÃReplace()¹ýÂË£»
2ÏÞÖÆÎı¾¿òÊäÈë×Ö·ûµÄ³¤¶È£»
3¼ì²éÓû§ÊäÈëµÄºÏ·¨ÐÔ£»¿Í»§¶ËÓë·þÎñÆ÷¶Ë¶¼ÒªÖ´ÐУ¬¿ÉÒÔʹÓÃÕýÔò¡£
4ʹÓôø²ÎÊýµÄSQLÓï¾äÐÎʽ¡£ 
ASP.NETÖÐÈçºÎ·À·¶SQL×¢Èëʽ¹¥»÷ 
 
Ò»¡¢Ê²Ã´ÊÇSQL×¢Èëʽ¹¥»÷£¿
¡¡¡¡ËùνSQL×¢Èëʽ¹¥»÷£¬¾ÍÊǹ¥»÷Õß°ÑSQLÃüÁî²åÈëµ½Web±íµ¥µÄÊäÈëÓò»òÒ³ÃæÇëÇóµÄ²éѯ×Ö·û´®£¬ÆÛÆ­·þÎñÆ÷Ö´ÐжñÒâµÄSQLÃüÁî¡£ÔÚijЩ±íµ¥ÖУ¬Óû§ÊäÈëµÄÄÚÈÝÖ±½ÓÓÃÀ´¹¹Ô죨»òÕßÓ°Ï죩¶¯Ì¬SQLÃüÁ»ò×÷Ϊ´æ´¢¹ý³ÌµÄÊäÈë²ÎÊý£¬ÕâÀà±íµ¥ÌرðÈÝÒ×Êܵ½SQL×¢Èëʽ¹¥»÷¡£³£¼ûµÄSQL×¢Èëʽ¹¥»÷¹ý³ÌÀàÈ磺
¡¡¡¡¢Å ij¸öASP.NET WebÓ¦ÓÃÓÐÒ»¸öµÇÂ¼Ò³Ãæ£¬Õâ¸öµÇÂ¼Ò³Ãæ¿ØÖÆ×ÅÓû§ÊÇ·ñÓÐȨ·ÃÎÊÓ¦Óã¬ËüÒªÇóÓû§ÊäÈëÒ»¸öÃû³ÆºÍÃÜÂë¡£
¡¡¡¡¢Æ µÇÂ¼Ò³ÃæÖÐÊäÈëµÄÄÚÈݽ«Ö±½ÓÓÃÀ´¹¹Ô춯̬µÄSQLÃüÁ»òÕßÖ±½ÓÓÃ×÷´æ´¢¹ý³ÌµÄ²ÎÊý¡£ÏÂÃæÊÇASP.NETÓ¦Óù¹Ôì²éѯµÄÒ»¸öÀý×Ó£º
System.Text.StringBuilder query = new System.Text.StringBuilder(
  "SELECT * from Users WHERE login = '")
  .Append(txtLogin.Text).Append("' AND password='")
  .Append(txtPassword.Text).Append("'");
¡¡¡¡¢Ç ¹¥»÷ÕßÔÚÓû§Ãû×ÖºÍÃÜÂëÊäÈë¿òÖÐÊäÈë"'»ò'1'='1"Ö®ÀàµÄÄÚÈÝ¡£
¡¡¡¡¢È Óû§ÊäÈëµÄÄÚÈÝÌá½»¸ø·þÎñÆ÷Ö®ºó£¬·þÎñÆ÷ÔËÐÐÉÏÃæµÄASP.NET´úÂë¹¹Ôì³ö²éѯÓû§µÄSQLÃüÁµ«ÓÉÓÚ¹¥»÷ÕßÊäÈëµÄÄÚÈݷdz£ÌØÊ⣬ËùÒÔ×îºóµÃµ½µÄSQLÃüÁî±ä³É£ºSELECT * from Users WHERE login = '' or '1'='1' AND password = '' or '1'='1'¡£
¡¡¡¡¢É ·þÎñÆ÷Ö´Ðвéѯ»ò´æ´¢¹ý³Ì£¬½«Óû§ÊäÈëµÄÉí·ÝÐÅÏ¢ºÍ·þÎñÆ÷Öб£´æµÄÉí·ÝÐÅÏ¢½øÐжԱȡ£
¡¡¡¡¢Ê ÓÉÓÚSQLÃüÁîʵ¼ÊÉÏÒѱ»×¢Èëʽ¹¥»÷Ð޸ģ¬ÒѾ­²»ÄÜÕæÕýÑéÖ¤Óû§Éí·Ý£¬ËùÒÔϵͳ»á´íÎóµØÊÚȨ¸ø¹¥»÷Õß¡£
¡¡¡¡Èç¹û¹¥»÷ÕßÖªµÀÓ¦ÓûὫ±íµ¥ÖÐÊäÈëµÄÄÚÈÝÖ±½ÓÓÃÓÚÑéÖ¤Éí·ÝµÄ²éѯ£¬Ëû¾Í»á³¢ÊÔÊäÈëÄ³Ð©ÌØÊâµÄSQL×Ö·û´®´Û¸Ä²éѯ¸Ä±äÆäÔ­À´µÄ¹¦ÄÜ£¬ÆÛƭϵͳÊÚÓè·ÃÎÊȨÏÞ¡£
¡¡¡¡ÏµÍ³»·¾³²»Í¬£¬¹¥»÷Õß¿ÉÄÜÔì³ÉµÄËðº¦Ò²²»Í¬£¬ÕâÖ÷ÒªÓÉÓ¦Ó÷ÃÎÊÊý¾Ý¿âµÄ°²È«È¨ÏÞ¾ö¶¨¡£Èç¹ûÓû§µÄÕÊ»§¾ßÓйÜÀíÔ±»òÆäËû±È½Ï¸ß¼¶µÄȨÏÞ£¬¹¥»÷Õ߾ͿÉÄܶÔÊý¾Ý¿âµÄ±íÖ´Ðи÷ÖÖËûÏëÒª×öµÄ²Ù×÷£¬°üÀ¨Ìí¼Ó¡¢É¾³ý»ò¸üÐÂÊý¾Ý£¬ÉõÖÁ¿ÉÄÜÖ±½Óɾ³ý±í¡£
¶þ¡¢ÈçºÎ·À·¶£¿
¡¡¡¡ºÃÔÚÒª·ÀÖ¹ASP.NETÓ¦Óñ»SQL×¢Èëʽ¹¥»÷´³Èë²¢²»ÊÇÒ»¼þÌØ±ðÀ§ÄѵÄÊÂÇ飬ֻҪÔÚÀûÓÃ±íµ¥ÊäÈëµÄÄÚÈݹ¹ÔìSQLÃüÁî֮ǰ£¬°ÑËùÓÐÊä


Ïà¹ØÎĵµ£º

sqlÓï¾ä¼¯½õ

SQLÓï¾ä¼¯½õ
--Óï ¾ä                                ¹¦ ÄÜ
--Êý¾Ý²Ù×÷
SELECT      --´ÓÊý¾Ý¿â±íÖмìË÷Êý¾ÝÐкÍÁÐ
INSERT& ......

sqlÖÐ in ¡¢not in ¡¢exists¡¢not exists Ó÷¨ºÍ²î±ð

exists £¨sql ·µ»Ø½á¹û¼¯ÎªÕ棩
not exists (sql ²»·µ»Ø½á¹û¼¯ÎªÕ棩
ÈçÏ£º
±íA
ID NAME
1    A1
2    A2
3  A3
±íB
ID AID NAME
1    1 B1
2    2 B2
3    2 B3
±íAºÍ±íBÊÇ£±¶Ô¶àµÄ¹ØÏµ A.ID => B.AID
......

ÅäÖà SQL Server 2005 Ô¶³Ìµ÷ÊÔ´æ´¢¹ý³Ì

ÎÊÌâ:
    Äú¹¤×÷µÄ±¾»ú×°ÓÐVisual Studio 2005£¬¾ÖÓòÍøÖÐÓÐһ̨SQL Server 2005Êý¾Ý¿â·þÎñÆ÷£¬ÄãÏëͨ¹ý±¾»úÔ¶³Ìµ÷ÊÔSQL Server 2005·þÎñÆ÷ÉϵĴ洢¹ý³Ì¡£µ«ÊDz»ÖªµÀÈçºÎÅäÖûòÆôÓÃÔ¶³Ìµ÷ÊÔ£¿Ï£ÍûÕâÆªÎÄÕ¶ÔÄúÓÐÓ᣶ÔÓÚÊý¾Ý¿âºÍVisual StudioÔÚͬһ»úÆ÷µÄ´æ´¢¹ý³Ìµ÷ÊÔ£¬Ô°×ÓÀïÒѾ­ÓÐһƪÒë×÷˵µÄºÜºÃÁË£¬¿ ......

¡¾SQL Server2008ÐÂÔö¹¦ÄÜС½á¡¿

/*----------------------------------------------------------------
-- Author  :feixianxxx(poofly)
-- Date    :2010-05-12 19:43:03
-- Version:
--      Microsoft SQL Server 2008 (SP1) - 10 ......

asp.netºǫ́Ïòǰ̨ע²ájsº¯ÊýºÍÊý×é

1. ×¢²ájsº¯Êý
String scriptString = "<script language=JavaScript>function doClick(){";
scriptString += "for(var index=0;index<myArray.length;index++)";
scriptString += "alert(myArray[index]);}<";
scriptString += "/" + "script>";
ClientScript.RegisterStartupScript(typeof(WebForm2) ......
© 2009 ej38.com All Rights Reserved. ¹ØÓÚE½¡ÍøÁªÏµÎÒÃÇ | Õ¾µãµØÍ¼ | ¸ÓICP±¸09004571ºÅ