SQLServer：不替换参数-SQLServer:Parameterisnotreplaced

2  

You can't see it being replaced in your debug session; the replacement occurs in the SQL server code itself...

您无法在调试会话中看到它被替换;替换发生在SQL服务器代码本身......

The client (your code) send both the SQL-string and the value of the parameter as seperate things to the server. There the SQL Engine 'replaces' the parameter with its value while executing it.

客户端(您的代码)将SQL字符串和参数的值作为单独的内容发送到服务器。在执行它时,SQL Engine会将参数替换为其值。

You should also put the 'wildcards' inside your parametervalue, not inside the query.

您还应该将'通配符'放在参数值内,而不是在查询中。

cmd = new SqlCommand("SELECT users From groups WHERE group_name LIKE @fv ", this.conn)
cmd.Parameters.Add("@fv", SqlDbType.NVarChar);
cmd.Parameters["@fv"].Value= "%" + filtervalue + "%";

1  

The parameter is not working because it is inside a string literal. You want to build the string like this:

该参数无效,因为它位于字符串文字内。你想构建这样的字符串:

cmd = new SqlCommand("SELECT users From groups WHERE group_name LIKE '%' + @fv + '%'");

While we're at it, keeping a global connection like that is bad. It can cause strange side effects, especially in web apps. Instead, keep a global connection string, and then use that string to create a new connection on each request.

虽然我们在这方面,但保持这样的全球联系是不好的。它可能会导致奇怪的副作用,尤其是在Web应用程序中。相反,保留一个全局连接字符串,然后使用该字符串在每个请求上创建一个新连接。

Also, "replace" is the wrong word here. Sql parameters are never replaced, even when they work. That's the whole point. There is no string replacement into your query at any point, ever. It's more like you declared an @fv variable at the server level in a stored procedure, and assigned your data directly to that variable. In this way, there is no possibility for a vulnerability in parameter replacement code, because the data portion of your query remains separate throughout the execution process. In same way, don't think in terms of "sanitizing" a parameter for a query; instead, think in terms of quarantining the data.

此外,“替换”在这里是错误的词。即使它们工作,也永远不会替换Sql参数。这就是重点。在任何时候都没有字符串替换您的查询。它更像是在存储过程中在服务器级别声明了@fv变量,并将数据直接分配给该变量。通过这种方式,参数替换代码中不存在漏洞,因为查询的数据部分在整个执行过程中保持独立。同样,不要考虑“清理”查询的参数;相反,请考虑隔离数据。