c# - 如何修复 CA2100 Review SQL 查询的安全漏洞问题

Question

我正在分析我的代码并遇到了这个安全问题:

CA2100 Review SQL queries for security vulnerabilities The query string passed to 'SqlDataAdapter.SqlDataAdapter(string, SqlConnection)' in 'Add_item.loadgrid()' could contain the following variables 'Login.dbName'. If any of these variables could come from user input, consider using a stored procedure or a parameterized SQL query instead of building the query with string concatenations. Login Add_item.cs 64

这是突出显示的代码:

SqlDataAdapter da = new SqlDataAdapter("SELECT Newjob FROM [" + Login.dbName + "].newjob", connection. conn );

Answer 1

这就是通常所说的 SQL 注入(inject)漏洞。您应该使用 sqlParameter 对象，而不是将值连接成一个字符串并将该字符串传递给 SQL Server。