用于查询接收字符串数组作为输入参数的 oracle 数据库的 Web API。我正在尝试使用命令参数来避免 Sql 注入，但是下面的代码不会抛出任何错误但没有给出结果。
public class PDataController : ApiController
{
public HttpResponseMessage Getdetails([FromUri] string[] id)
{
List<OracleParameter> prms = new List<OracleParameter>();
string connStr = ConfigurationManager.ConnectionStrings["PDataConn"].ConnectionString;
using (OracleConnection dbconn = new OracleConnection(connStr))
{
var inconditions = id.Distinct().ToArray();
var srtcon = string.Join(",", inconditions);
DataSet userDataset = new Dataset();
var strQuer = @"SELECT STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY,
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER,
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE,
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME
FROM STCD_PRIO_CATEGORY_DESCR
WHERE STCD_PRIO_CATEGORY_DESCR.STD_REF(";
StringBuilder sb = new StringBuilder(strQuery);
for(int x = 0; x < inconditions.Length; x++)
{
sb.Append(":p" + x + ",");
OracleParameter p = new OracleParameter(":p" + x,OracleDbType.NVarchar2 );
p.Value = inconditions[x];
prms.Add(p);
}
if(sb.Length > 0) sb.Length--;
strQuery = strQuery + sb.ToString() + ")";
using (OracleCommand selectCommand = new OracleCommand(strQuery, dbconn))
{
selectCommand.Parameters.AddRange(prms.ToArray());
using (OracleDataAdapter adapter = new OracleDataAdapter(selectCommand))
{
DataTable selectResults = new DataTable();
adapter.Fill(selectResults);
var returnObject = new { data = selectResults };
var response = Request.CreateResponse(HttpStatusCode.OK, returnObject, MediaTypeHeaderValue.Parse("application/json"));
ContentDispositionHeaderValue contentDisposition = null;
if (ContentDispositionHeaderValue.TryParse("inline; filename=ProvantisStudyData.json", out contentDisposition))
{
response.Content.Headers.ContentDisposition = contentDisposition;
}
return response;
}
}
}
}
}
以下是我在 selectCommand 的 commandText 中调试时得到的结果
"SELECT \r\n STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, \r\n
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, \r\n
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, \r\n
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME \r\n
FROM \r\n
STCD_PRIO_CATEGORY_DESCR \r\n
WHERE \r\n
STCD_PRIO_CATEGORY_DESCR.STD_REF IN(SELECT \r\n
STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, \r\n
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, \r\n
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, \r\n
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME \r\n
FROM \r\n
STCD_PRIO_CATEGORY_DESCR \r\n
WHERE \r\n
STCD_PRIO_CATEGORY_DESCR.STD_REF IN(:p0)"
因为我现在给
strQuery = strQuery+ sb.ToString() + ")";
正在重复选择。但如果我只是给
strQuery = sb.ToString() + ")";
而调试时的 strQuery 是
SELECT \r\n STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, \r\n
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, \r\n
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, \r\n
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME \r\n
FROM \r\n
STCD_PRIO_CATEGORY_DESCR \r\n
WHERE \r\n
STCD_PRIO_CATEGORY_DESCR.STD_REF IN(:p0)
我得到的回报是
{"data":[]}
我应该将 p0 括在 '' 中，因为我们收到的输入是字符串数组。
但是当我在 SQL 开发人员中尝试使用相同的 ID 时，我得到了记录。任何帮助是极大的赞赏。