通过从上一页传递参数从 Db 中检索值 - ASP.NET C#

Question

我是 ASP.Net 的新手，

从上一页传递用户 ID 时，我在从数据库中检索员工信息时遇到问题。 从第 1 页的数据网格中选择时，我设法传递了用户 ID，但是在加载第 2 页时，它给了我一个错误：无效的列名“传递的字符串值”

下面是我的代码：

第 1 页：

protected void imgBtnView_Click(object sender, ImageClickEventArgs e)

{
        ImageButton imgBtn = (ImageButton)sender;
        string UserID = imgBtn.CommandArgument;
        Response.Redirect("Employee.aspx?UserID=" + UserID);
}

第 2 页：

页面加载

protected void Page_Load(object sender, EventArgs e)
{     
   txtEmployeeNo.Text = Request.QueryString["UserID"]; 
   FillFields(txtEmployeeNo.Text);
}

方法填充字段

private void FillFields(string User_ID)
{
    String commandString = @"SELECT * FROM [dbo].[Tbl_Employee] WHERE 
    [UserID] = "+ User_ID;
    DataRow dr = Global.StartQuery(commandString).Rows[0]; -- > global class
    txtEmployeeNo.Text = User_ID;
    txtFirstName.Text = dr["FirstName"].ToString(); 
    txtLastName.Text =  dr["LastName"].ToString();
}

请告诉我代码中有什么问题。

提前谢谢你

Answer 1

使用以下代码行。

String commandString = @"SELECT * FROM [dbo].[Tbl_Employee] WHERE 
[UserID] = '"+User_ID+"'";

Answer 2

您应该将此代码添加到 Page_Load 事件中

if (!IsPostBack)
{
   //Your operations
}

Answer 3

非常不鼓励在浏览器 url 中传递敏感信息。如果需要的信息应该被散列或加密（推荐加密）。可以使用在查询字符串会话中传递值而不是传递值。虽然仍然可以劫持会话； session 可以被认为比 url 中的纯文本更安全。所以使用会话你的上述问题可以解决为

protected void imgBtnView_Click(object sender, ImageClickEventArgs e)
{
   ImageButton imgBtn = (ImageButton)sender;
   //string UserID = imgBtn.CommandArgument; //just ignored intermediate value holder
   Session["UserID"] = imgBtn.CommandArgument;
   Response.Redirect("Employee.aspx");
}

protected void Page_Load(object sender, EventArgs e)
{     
  if(!IsPostBack) //Do stuff only during page first load.
  {
   //Check if session is null. 
   string userId = Session["UserID"]==null? String.Empty : Session["UserID"].ToString(); 
   txtEmployeeNo.Text = userId;
   if(!String.IsNullOrEmpty(userId))
   {
      FillFields(userId);
   }
  }
}

//This method should return datatable or DataRow and avoid setting control value. 
//Returing datatable or DataRow makes this method more reusable.
private void FillFields(string User_ID)
{
    //This way of execuring sql query is highly discourage. 
    //You should use parametrized sql command or use store procedure.
    String commandString = @"SELECT * FROM [dbo].[Tbl_Employee] WHERE 
    [UserID] = '"+ User_ID + "'"; 
    DataRow dr = Global.StartQuery(commandString).Rows[0]; -- > global class
    txtEmployeeNo.Text = User_ID;
    txtFirstName.Text = dr["FirstName"].ToString(); 
    txtLastName.Text =  dr["LastName"].ToString();
}

Page_Load 和方法的变化很少。

protected void Page_Load(object sender, EventArgs e)
    {     
      if(!IsPostBack) //Do stuff only during page first load.
      {
       //Check if session is null. 
       string userId = Session["UserID"]==null? String.Empty : Session["UserID"].ToString(); 
       txtEmployeeNo.Text = userId;
       if(!String.IsNullOrEmpty(userId))
       {
          DataRow dr = FillFields(userId);
          txtEmployeeNo.Text = User_ID;
          txtFirstName.Text = dr["FirstName"].ToString(); 
          txtLastName.Text =  dr["LastName"].ToString();
       }
      }
    }

private DataRow FillFields(string User_ID)
    {
        //This way of execuring sql query is highly discourage. 
        //You should use parametrized sql command or use store procedure.
        String commandString = @"SELECT * FROM [dbo].[Tbl_Employee] WHERE 
        [UserID] = '"+ User_ID + "'"; 
        DataRow dr = Global.StartQuery(commandString).Rows[0]; -- > global class
        return dr;
    }

当传递了无效的 UserID 时，FillFields 仍然可以通过异常。假设 UserId 值为 5，并且该用户 ID 没有记录，那么 FillFields 将不会因此返回数据行

DataRow dr = Global.StartQuery(commandString).Rows[0];
//will throw exception as you are trying to access first row 
//where row are not available. You must handle this scenario.