2

我正在使用 asp.net MVC 4 创建一个网站，用户可以在其中上传.xlsx文件并将数据保存到 MSSQL 表中。我想在保存数据之前确保文件中没有非法字符，例如SQL注入语句。到目前为止，我用$符号测试它工作正常，但它只会在一个单元格只有那个字符而不是在字符之间时才能捕捉到。这是我的代码，

控制器

    public ActionResult BulkReadings()
    {
        string pathToExcelFile = System.IO.Path.Combine(Server.MapPath("~/ExcelFiles/"), "BulkReads.xlsx");
        string sheetName = "Sheet1";

        var excelFile = new ExcelQueryFactory(pathToExcelFile);
        var getSheet = from a in excelFile.Worksheet(sheetName) select a;
        string Subject = "";
        string Type = "";
        string Reading = "";

        foreach (var a in getSheet)
        {
            if (a["Subject"] == "$" || a["Type"] == "$" || a["Reading"] == "$")  // This is where it checks for the "$" sign
            {
                if (System.IO.File.Exists(pathToExcelFile))
                {
                    System.IO.File.Delete(pathToExcelFile);
                }
                TempData["meter_fail"] = "Error! Illegal Characters!";
                return RedirectToAction("MeterManager");
            }
            else
            {
                Subject = a["Subject"];
                Type = a["Type"];
                Reading = a["Reading"];
                try
                {
                    Reading newEntry = new Reading();
                    newEntry.title = Subject;
                    newEntry.type = Type;
                    newEntry.reading1 = Reading;
                    rentdb.Readings.Add(newEntry);
                }
                catch
                {
                    if (System.IO.File.Exists(pathToExcelFile))
                    {
                        System.IO.File.Delete(pathToExcelFile);
                    }
                    TempData["meter_fail"] = "Error! Upload Failed!";
                    return RedirectToAction("MeterManager");
                }
            }
        }
        rentdb.SaveChanges();
        if (System.IO.File.Exists(pathToExcelFile))
        {
            System.IO.File.Delete(pathToExcelFile);
        }
        TempData["meter_success"] = "Reading(s) uploaded successfully!";
        return RedirectToAction("MeterManager");
    }

如何检查多个非法字符，这些非法字符可以作为单个字符出现，也可以与单元格中的其他字符一起出现？

4

1 回答 1

1

正如@Sam Ax 所说，避免 sql 注入攻击的最佳方法是参数化您的查询。参数是值的占位符，而不是使用用户输入的值。

例如：

using (SqlConnection conn = new SqlConnection(NorthwindConnectionString))
{
    string query = "SELECT * FROM Products WHERE ProductID = @Id";
    SqlCommand cmd = new SqlCommand(query, conn);
    cmd.Parameters.AddWithValue("@Id", Request.QueryString["Id"]);
    conn.Open();
    using (SqlDataReader rdr = cmd.ExecuteReader())
    {
        DetailsView1.DataSource = rdr;
        DetailsView1.DataBind();
    }
}

这里有一些关于它的进一步阅读： https ://msdn.microsoft.com/library/bb738521(v=vs.100).aspx

于 2016-02-06T05:48:09.560 回答