使用命令參數避免SQL注入

Question

我們創建了用於查詢Oracle數據庫的WebAPI。 API接收ID的字符串數組作爲輸入參數。下面是我們正在使用的API控制器，但建議使用命令參數來避免SQLite注入。下面是我們使用

public HttpResponseMessage Getdetails([FromUri] string[] id) 
{ 
string connStr = ConfigurationManager.ConnectionStrings["ProDataConnection"].ConnectionString; 
using (OracleConnection dbconn = new OracleConnection(connStr)) 
{ 
    var inconditions = id.Distinct().ToArray(); 
    var srtcon = string.Join(",", inconditions); 
    DataSet userDataset = new DataSet(); 
    var strQuery = @"SELECT * from STCD_PRIO_CATEGORY where STPR_STUDY.STD_REF IN(" + srtcon + ")"; 
    using (OracleCommand selectCommand = new OracleCommand(strQuery, dbconn)) 
    { 
      using (OracleDataAdapter adapter = new OracleDataAdapter(selectCommand)) 
     { 
      DataTable selectResults = new DataTable(); 
      adapter.Fill(selectResults); 
      var returnObject = new { data = selectResults }; 
      var response = Request.CreateResponse(HttpStatusCode.OK, returnObject, MediaTypeHeaderValue.Parse("application/json")); 
      ContentDispositionHeaderValue contentDisposition = null; 

      if (ContentDispositionHeaderValue.TryParse("inline; filename=ProvantisStudyData.json", out contentDisposition)) 
      { 
       response.Content.Headers.ContentDisposition = contentDisposition; 
      } 

      return response; 
     } 
    } 
} 
} 

我試着用搜索引擎就這個問題和發現

var strQuery = @"SELECT * from STCD_PRIO_CATEGORY where STPR_STUDY.STD_REF IN(@strcon)"; 
    using (OracleCommand selectCommand = new OracleCommand(strQuery, dbconn)) 
    { 
    using (OracleDataAdapter adapter = new OracleDataAdapter(selectCommand)) 
     {   
adapter.SelectCommand.Parameters.Add("@strcon",strcon); 

，我會被直接給予STRCON變量，其中我參加字符串數組的代碼。我是新的C＃和Asp.Net，非常感謝任何幫助。 謝謝

Answer 1

正如我的評論中所解釋的，您不能爲IN子句創建一個唯一的參數，並且所有值都需要用逗號分隔。這會創建一個字符串值，而不是要在您的STD_REF字段中搜索的ID列表。相反，您需要更長的方法，爲每個值創建一個不同的參數並正確準備IN子句

List<OracleParameter> prms = new List<OracleParameter>(); 
var strQuery = @"SELECT * from STCD_PRIO_CATEGORY 
        where STPR_STUDY.STD_REF IN("; 

// Create a list of parameters and prepare the placeholders for the IN  
StringBuilder sb = new StringBuilder(strQuery); 
for(int x = 0; x < inconditions.Length; x++) 
{ 
    // Placeholder 
    sb.Append(":p" + x + ","); 

    // Parameter 
    OracleParameter p = new OracleParameter(":p" + x, OracleType.Int32); 
    p.Value = inconditions[x]; 
    prms.Add(p); 
} 

// Remove the last comma 
if(sb.Length > 0) sb.Length--; 
// Prepare the correct IN clause 
strQuery = sb.ToString() + ")"; 

using (OracleCommand selectCommand = new OracleCommand(strQuery, dbconn)) 
{ 
    // Add the whole set of parameters 
    selectCommand.Parameters.AddRange(prms.ToArray()); 
    using (OracleDataAdapter adapter = new OracleDataAdapter(selectCommand)) 
    {   
     DataTable selectResults = new DataTable(); 
     adapter.Fill(selectResults); 
     .....