0

我正在使用 ASP.NET 4.0 和 SQL Server 2008 开发一个网站。在登录页面中，我必须检查用户供应商 ID，并根据供应商 ID 将页面重定向到不同的页面。一切正常，但我不知道如何检查管理员何时输入他的 VendorID 和密码，以便重定向管理页面。他的供应商 ID 和密码也与其他用户存储在同一个表“User_Info”中。参考下面的代码，它总是重定向到管理员页面只是因为我直接在代码中提供了他的 vendorID 和密码。请提出您的建议来解决这个问题。

    protected void BtnHomeUserSubmit_Click(object sender, EventArgs e)
     {
      SqlConnection SqlCon = new SqlConnection(GetConnectionString());
      try
      {          
       var da1 = new SqlDataAdapter("select * from User_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon);
           var dt1 = new DataTable();
           da1.Fill(dt1);
           if (dt1.Rows.Count == 0)
           {
            ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert", "alert('Enter valid Vendor ID and Password');", true);
           }
           else
           {
            var da = new SqlDataAdapter("select * from User_Info where Vendor_ID='Admin' AND User_Password='123456'", SqlCon);
              var dt = new DataTable();
              da.Fill(dt);
              if (dt.Rows.Count > 0)
              {
                Response.Redirect("~/AdminCompanyInfo.aspx");
              }
              var da2 = new SqlDataAdapter("select * from Company_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND Approval_Status='NO' OR                              Approval_Status='PEN'", SqlCon);
              var dt2 = new DataTable();
              da2.Fill(dt2);
              if (dt2.Rows.Count > 0)
              {
               string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text);
               ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID is waiting for Approval');window.location.href = '" +                       url + "';", true);
              }
              var da3 = new SqlDataAdapter("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'", SqlCon);
              var dt3 = new DataTable();
              da3.Fill(dt3);
              if (dt3.Rows.Count > 0)
              {
                  string url = "../UserLogin.aspx";
                  ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID already completed the registration');window.location.href = '" + url + "';", true);
              }
              else
              {
                Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text));
              }
           }
        }
        finally
        {
            SqlCon.Close();
        }
    }
4

2 回答 2

1

试试这个.. 当你构建一个架构时，考虑这个访问数据库是代码中最昂贵的访问。并且更喜欢使用 SqlCommand（参数化值）。

 var da1 = new SqlDataAdapter("select * from User_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon);
           var dt1 = new DataTable();
           da1.Fill(dt1);
           if (dt1.Rows.Count == 0)
           {
            ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert", "alert('Enter valid Vendor ID and Password');", true);
           }
           else
           {

             switch(dt.Rows[0]["Vendor_ID"].ToString())
              {
               case "Admin": Response.Redirect("~/AdminCompanyInfo.aspx"); break;
              //other oprtions goes here...
              }
              var da2 = new SqlDataAdapter("select * from Company_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND Approval_Status='NO' OR                              Approval_Status='PEN'", SqlCon);
              var dt2 = new DataTable();
              da2.Fill(dt2);
              if (dt2.Rows.Count > 0)
              {
               string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text);
               ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID is waiting for Approval');window.location.href = '" +                       url + "';", true);
              }
              var da3 = new SqlDataAdapter("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'", SqlCon);
              var dt3 = new DataTable();
              da3.Fill(dt3);
              if (dt3.Rows.Count > 0)
              {
                  string url = "../UserLogin.aspx";
                  ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID already completed the registration');window.location.href = '" + url + "';", true);
              }
              else
              {
                Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text));
              }
           }
于 2012-08-12T09:29:33.670 回答
0

虽然给出的示例是功能性的，但 SQL 注入在这里是一个大问题。您应该使用参数化查询。

http://blogs.msdn.com/b/sqlphp/archive/2008/09/30/how-and-why-to-use-parameterized-queries.aspx

于 2012-08-12T15:47:04.057 回答