ASP.net VB 搜索引擎

Question

我有一个搜索引擎，它应该通过产品描述进行搜索，然后会显示包含用户正在寻找的任何单词或短语的产品列表。不过，我还没有为使用该描述的产品列出任何类型的列表。

我只需要弄清楚为什么我的 SELECT 语句没有做任何事情。要么是那个，要么是 For Each 循环。

这就是我所拥有的：

 Public Function GetDescriptions(ByVal prefixText As String, ByVal count As Integer) As String()
    Dim MarketingSql As String = "Select MarketingID, MarketingType, MarketingData FROM Marketing WHERE MarketingType = 2 AND MarketingData LIKE '%" & prefixText & "%'"
    Dim sqlConn As New SqlConnection
    sqlConn.Open()
    Dim myCommand As New SqlCommand(MarketingSql, sqlConn)
    Dim myReader As SqlDataReader = myCommand.ExecuteReader()
    Dim myTable As New DataTable
    myTable.TableName = "DescriptionSearch"
    myTable.Load(myReader)
    sqlConn.Close()
    Dim items As String() = New String(myTable.Rows.Count - 1) {}
    Dim i As Integer = 0
    For Each dr As DataRow In myTable.Rows
        items.SetValue(dr("MarketingData").ToString(), i)
        i += 1
    Next
    Return items
End Function


<asp:Content ID="Content1" ContentPlaceHolderID="head" Runat="Server">
<script type="text/javascript">
function AutoCompleteClientMethod(source, eventArgs) {
    var value = eventArgs.get_value();
    window.location = ("/Product/Default.aspx?id=" + value)
} 
</script>
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="body" Runat="Server">
    <asp:ScriptManager ID="ScriptManager1" runat="server">
    <Services>
        <asp:ServiceReference Path="DescriptionSearch.asmx" />
    </Services>
</asp:ScriptManager>
    <asp:TextBox ID="Search" runat="server" AutoComplete="off"></asp:TextBox>
    <asp:AutoCompleteExtender ID="AutoCompleteExtender1" runat="server" TargetControlID="Search" ServicePath="~/DescriptionSearch.asmx" ServiceMethod="GetDescriptions" MinimumPrefixLength="1" CompletionSetCount="255" EnableCaching="true" OnClientItemSelected="AutoCompleteClientMethod">
    </asp:AutoCompleteExtender>
</asp:Content>

Answer 1

我立即发现您的代码存在三个大问题：

1. 正如您所说，您的代码容易受到 sql 注入的攻击。您将其上线，任何愿意尝试的人都将完全拥有您的数据库。这甚至不难。 “首先让它发挥作用”的策略是一种完全倒退和错误的方法来解决这个问题。像这样的代码经常会投入生产。
2. 您正在使用 LIKE 运算符搜索冗长的文本列。这将消耗您的数据库性能。这是全文索引和CONTAINS 函数的好地方。搜索时间将是白天和黑夜。
3. 您并不总是关闭数据库连接。如果抛出异常，您将泄漏打开的连接对象，这最终可能导致对您的数据库的有效拒绝服务攻击，该攻击源自您自己的应用程序。数据库连接必须始终包含在 try/finally 块中。

这只是冰山一角，仅从略读中收集到的。我什至还没有开始深入阅读代码。

---

这是一个更新（迟到了，我知道），基于修复 sql 注入问题的自我接受的答案：

 <WebMethod()> _
Public Function GetDescriptions(ByVal prefixText As String, ByVal count As Integer)
As List(Of String)
    Dim MarketingSql As String = "Select DISTINCT p.ProductID, p.ProductName 
      FROM Product p 
      INNER JOIN Marketing m ON p.ProductID = m.ProductID 
      INNER JOIN Picklist k ON k.PicklistID = m.MarketingData 
      WHERE m.MarketingTypeID = 2 AND k.Data LIKE '%' + @prefixText + '%' 
      ORDER BY p.ProductName ASC"

    Using sqlConn As New SqlConnection
      (System.Configuration.ConfigurationManager.ConnectionStrings
      ("LocalSqlServer").ConnectionString), _
          myCommand As New SqlCommand(MarketingSql, sqlConn)

        myCommand.Parameters.Add("@prefixText", SqlDbTypes.VarChar, 50).Value = prefixText
        sqlConn.Open()
        Using myReader As SqlDataReader = myCommand.ExecuteReader()
            While myReader.Read()
                Dim id As String = myReader("ProductID").ToString()
                Dim name As String = myReader("ProductName").ToString()
                items.Add(AjaxControlToolkit.AutoCompleteExtender.CreateAutoCompleteItem(name, id))
            End While
         End Using
     End Using
     Return items
End Function

Answer 2

这就是为项目更新 WebService 的方式。现在可以正常使用了。

 <WebMethod()> _
Public Function GetDescriptions(ByVal prefixText As String, ByVal count As Integer)
As String()
    Dim MarketingSql As String = "Select DISTINCT p.ProductID, p.ProductName 
FROM Product p 
INNER JOIN Marketing m ON p.ProductID = m.ProductID 
INNER JOIN Picklist k ON k.PicklistID = m.MarketingData 
WHERE m.MarketingTypeID = 2 AND k.Data LIKE '%' & @prefixText & '%' 
ORDER BY p.ProductName ASC"
    Using sqlConn As New SqlConnection
      (System.Configuration.ConfigurationManager.ConnectionStrings
      ("LocalSqlServer").ConnectionString)
    sqlConn.Open()
    Dim myCommand As New SqlCommand(MarketingSql, sqlConn)
    myCommand.Parameters.Add("@prefixText", SqlDbType.VarChar, 50).Value = prefixText
    Dim myReader As SqlDataReader = myCommand.ExecuteReader()
    Dim myTable As New DataTable
    myTable.TableName = "DescriptionSearch"
    myTable.Load(myReader)
    sqlConn.Close()
    Dim items As String() = New String(myTable.Rows.Count - 1) {}
    Dim i As Integer = 0
    For Each dr As DataRow In myTable.Rows
        Dim id As String = dr("ProductID").ToString()
        Dim name As String = dr("ProductName").ToString()
        Dim item As String = AjaxControlToolkit.AutoCompleteExtender.CreateAutoCompleteItem(name, id)
        items.SetValue(item, i)
        i += 1
    Next
    Return items
    End Using
End Function

Answer 3

除了 Joel 的 cmets，您真的真的需要永远不要将 Select 语句放入您的代码中（即使在测试时）......永远。始终使用存储过程。现在我需要做的就是阅读你的 web.config 文件（假设你没有花时间加密它），阅读你的连接，我可以完全访问你的所有数据。