vb.net datareader 之前未使用时已打开错误

Question

您好，我有这个子作为我的登录/注销系统的一部分。当调用此子程序来登录用户时，它可以正常工作，但是在注销时会引发一个对我来说没有任何意义的错误。

Sub validate_session()
        Dim email As String = System.Web.HttpContext.Current.Session("email")
        Dim key As String = System.Web.HttpContext.Current.Session("sid")

        'check against db
        Dim objConnCheck As System.Data.SqlClient.SqlConnection
        Dim objCmdCheck As System.Data.SqlClient.SqlCommand
        Dim strConnStringCheck, strSQLCheck As String

        'establish connection
        objConnCheck = New SqlConnection(ConfigurationManager.ConnectionStrings("dbAlumniReadConnectionString").ConnectionString)
        objConnCheck.Open()

        strSQLCheck = "SELECT * FROM users WHERE email = @email AND session_key = @ssession_hash"
        objCmdCheck = New System.Data.SqlClient.SqlCommand(strSQLCheck, objConnCheck)

        With objCmdCheck
            .Parameters.Add(New SqlParameter("@email", email))
            .Parameters.Add(New SqlParameter("@ssession_hash", key))
        End With

        'take the approiate action
        Dim u As SqlDataReader = objCmdCheck.ExecuteReader()
        If u.HasRows = True Then
            Dim refresh = New hashing
            refresh.create_session_key(email)

        Else
            System.Web.HttpContext.Current.Session("email") = ""
            System.Web.HttpContext.Current.Session("sid") = ""

            'clean out db field
            'update db
            Dim objConnRemove As System.Data.SqlClient.SqlConnection
            Dim objCmdRemove As System.Data.SqlClient.SqlCommand
            Dim strConnStringRemove, strSQLRemove As String

            'establish connection
            objConnRemove = New SqlConnection(ConfigurationManager.ConnectionStrings("dbAlumniAdminConnectionString").ConnectionString)
            objConnRemove.Open()

            strSQLRemove = "UPDATE users SET session_key = "" WHERE email = @semail"
            objCmdRemove = New System.Data.SqlClient.SqlCommand(strSQLCheck, objConnCheck)

            With objCmdRemove
                .Parameters.Add(New SqlParameter("@semail", email))
            End With

            objCmdRemove.ExecuteNonQuery()

            objConnRemove.Close()
            objConnRemove.Close()

        End If

        objConnCheck.Close()
        objConnCheck.Close()

    End Sub

当作为注销逻辑的一部分运行时，它会抛出此错误：

There is already an open DataReader associated with this Command which must be closed first. - objCmdRemove.ExecuteNonQuery() -

这是注销子：

Sub logout() Handles Me.Load
    System.Web.HttpContext.Current.Session("email") = "ghost"
    Dim logging_out = New common
    logging_out.validate_session()

    Response.Redirect("login.aspx?l=out")

End Sub

这会设置一个无意义的电子邮件地址，因此当 validate_session 在数据库中搜索有效的电子邮件/会话组合时，它会破坏敏感会话数据。

问题归结为：为什么logout sub调用validate_session时会抛出错误？

Answer 1

在完成后尝试处理 DataReader。像这样：

u.Close()
u = Nothing

所以你的代码应该是这样的

Sub validate_session()

        [....]  'your code here

        Dim u As SqlDataReader = objCmdCheck.ExecuteReader()

        If u.HasRows = True Then
                 'Your code here
        Else
                 'Your other code goes here
        End If

        u.close             ' This is where you should pay attention
        u = Nothing

        [...]   'rest of your code here    
    End Sub