帮助在 ASP 4、VB 中构建 WebService

Question

我有一个搜索引擎，它将使用网络服务来搜索我的数据库以查找 3 个特定的东西。我什至不知道它是否会像这样工作，但我的主页上有一个下拉列表，可以选择产品、功能、描述。根据用户的选择，Web 服务应该转到 if 语句以使用正确的 SELECT 语句并查找搜索结果。

有人会帮我弄清楚如何修复我所写的内容以使其正常工作吗？请不要太挑剔，我没有太多经验。我也一直在研究 SQL 注入，因为我有很多易受攻击的代码，所以当你查看我的代码时请记住这一点。

我无法让位于 WebService 页面上 DropdownList1.Value 实例下方的蓝色波浪线消失。

网络服务：

        <WebMethod()> _
Public Function GetCompletionList(ByVal prefixText As String, ByVal count As Integer) As String()
    Dim Feature As String = DropDownList1.Value 
    Dim Description As String = DropDownList1.Value 
    Dim Product As String = DropDownList1.Value 

    If Feature Then
        Dim FeatureSql As String = "Select FeatureTitle FROM Feature WHERE FeatureTitle LIKE " + " " '%" + prefixText + "'"
        Dim sqlConn As New SqlConnection("Server=off-db1;uid=productsDB_admin;pwd=******;database=Products")
        sqlConn.Open()
        Dim myCommand As New SqlCommand(FeatureSql, sqlConn)
        Dim myReader As SqlDataReader = myCommand.ExecuteReader()
        Dim myTable As New DataTable
        myTable.TableName = "FeatureSearch"
        myTable.Load(myReader)
        sqlConn.Close()
        Dim items As String() = New String(myTable.Rows.Count - 1) {}
        Dim i As Integer = 0
        For Each dr As DataRow In myTable.Rows
            items.SetValue(dr("FeatureTitle").ToString(), i)
            i += 1
        Next
        Return items
    End If

    If Description Then
        Dim MarketingSql As String = "Select MarketingType, MarketingData FROM Marketing WHERE MarketingType = '2' AND MarketingData LIKE " + " " '%" + prefixText + "'"
        Dim sqlConn As New SqlConnection("Server=off-db1;uid=productsDB_admin;pwd=*****;database=Products")
        sqlConn.Open()
        Dim myCommand As New SqlCommand(MarketingSql, sqlConn)
        Dim myReader As SqlDataReader = myCommand.ExecuteReader()
        Dim myTable As New DataTable
        myTable.TableName = "DescriptionSearch"
        myTable.Load(myReader)
        sqlConn.Close()
        Dim items As String() = New String(myTable.Rows.Count - 1) {}
        Dim i As Integer = 0
        For Each dr As DataRow In myTable.Rows
            items.SetValue(dr("MarketingType").ToString(), i)
            items.SetValue(dr("MarketingData").ToString(), i)
            i += 1
        Next
        Return items
    End If

    If Product Then
        Dim ProductSql As String = "Select ProductName FROM Product WHERE ProductName LIKE " + " " '%" + prefixText + "'"
        Dim sqlConn As New SqlConnection("Server=off-db1;uid=productsDB_admin;pwd=*****;database=Products")
        sqlConn.Open()
        Dim myCommand As New SqlCommand(ProductSql, sqlConn)
        Dim myReader As SqlDataReader = myCommand.ExecuteReader()
        Dim myTable As New DataTable
        myTable.TableName = "ProductSearch"
        myTable.Load(myReader)
        sqlConn.Close()
        Dim items As String() = New String(myTable.Rows.Count - 1) {}
        Dim i As Integer = 0
        For Each dr As DataRow In myTable.Rows
            items.SetValue(dr("ProductName").ToString(), i)
            i += 1
        Next
        Return items
    End If

End Function
End Class

Default.aspx 页面 - 我需要下拉列表以某种方式与数据库绑定。

   <asp:ScriptManager ID="ScriptManager1" runat="server">
    <Services>
        <asp:ServiceReference Path="AutoComplete.asmx" />
    </Services>
    </asp:ScriptManager>
    Search by: 
    <asp:DropDownList ID="DropDownList1" runat="server">
        <asp:ListItem>Product</asp:ListItem>
        <asp:ListItem>Feature</asp:ListItem>
        <asp:ListItem>Description</asp:ListItem>
    </asp:DropDownList>
    <asp:TextBox ID="Search" runat="server"></asp:TextBox>
    <asp:AutoCompleteExtender ID="AutoCompleteExtender1" runat="server" TargetControlID="Search" ServicePath="AutoComplete.asmx" ServiceMethod="GetCompletionList" MinimumPrefixLength="3" CompletionSetCount="120" EnableCaching="true">
    </asp:AutoCompleteExtender>

Answer 1

我删除了下拉列表并测试了其中一个选择语句的代码，以确保它正常工作。当他们说下拉菜单不能按照我想要的方式与 web 服务一起工作时，每个人都是对的。 :(

这是我现在拥有的：

<asp:ScriptManager ID="ScriptManager1" runat="server">
    <Services>
        <asp:ServiceReference Path="FeatureSearch.asmx" />
    </Services>
</asp:ScriptManager>     

<asp:TextBox ID="Search" runat="server"></asp:TextBox>
     <asp:AutoCompleteExtender ID="AutoCompleteExtender1" runat="server" TargetControlID="Search" ServicePath="~/FeatureSearch.asmx" ServiceMethod="GetCompletionList" MinimumPrefixLength="2" CompletionSetCount="120" EnableCaching="true">
    </asp:AutoCompleteExtender>

  <WebMethod()> _
Public Function GetCompletionList(ByVal prefixText As String, ByVal count As Integer) As String()
    Dim ProductSql As String = "Select ProductName FROM Product WHERE ProductName LIKE '" & prefixText & "%'"
    Dim sqlConn As New SqlConnection
    sqlConn.Open()
    Dim myCommand As New SqlCommand(ProductSql, sqlConn)
    Dim myReader As SqlDataReader = myCommand.ExecuteReader()
    Dim myTable As New DataTable
    myTable.TableName = "ProductSearch"
    myTable.Load(myReader)
    sqlConn.Close()
    Dim items As String() = New String(myTable.Rows.Count - 1) {}
    Dim i As Integer = 0
    For Each dr As DataRow In myTable.Rows
        Dim id As String = dr("ProductID").ToString()
        Dim name As String = dr("ProductName").ToString()
        Dim item As String = AjaxControlToolkit.AutoCompleteExtender.CreateAutoCompleteItem(name, id)
        items.SetValue(item, i)
    Next
    Return items
End Function