【发布时间】:2023-03-30 02:36:01
【问题描述】:
在 microsoft sql server 2005 经典的 asp 代码中,我使用以下代码调用 sql 查询:
selectHireResponseSQL = "
SELECT HireResponseID, HireResponse, DateResponse, Comments, YearFileOpened
, file_number, isCaseOpen, last_update, isConfidential, date_created
, OurClient, TheirClient, ProjectName, DESCRIPTION, lawyer_lastname
, lawyer_firstname, Conflicts.ConflictID
FROM Hire_Response
, Conflicts
, Lawyers
WHERE Hire_Response.ConflictID = Conflicts.ConflictID
AND Lawyers.lawyerID = Conflicts.lawyerID
AND firmID IN (" & FirmIDString & ")
AND HireID = " & HireID & "
AND isStillaConflict = 1
ORDER BY
file_number
, TheirClient
, OurClient
, lawyer_lastname
, lawyer_firstname
"
以上不是存储过程。
此外,FirmIDString 变量是一个字符串,它是一个以逗号分隔的数字列表,例如 '1,2,3'。
字符串被格式化后的一个例子是:
select HireResponseID, HireResponse, DateResponse, Comments, YearFileOpened, file_number, isCaseOpen, last_update, isConfidential, date_created, OurClient, TheirClient, ProjectName, description, lawyer_lastname, lawyer_firstname, Conflicts.ConflictID
from Hire_Response, Conflicts, Lawyers
WHERE Hire_Response.ConflictID=Conflicts.ConflictID AND Lawyers.lawyerID=Conflicts.lawyerID AND firmID IN (47,140,138,137,139) AND HireID = 594 AND isStillaConflict = 1
ORDER BY file_number, TheirClient, OurClient, lawyer_lastname, lawyer_firstname
现在我想把它变成一个存储过程。于是我把asp经典代码改成了
selectHireResponseSQL = "
EXEC ps_selectHireResponseSQL '" & FirmIDString & "'," & HireID
而存储过程是:
SELECT HireResponseID, HireResponse, DateResponse, Comments, YearFileOpened
, file_number, isCaseOpen, last_update, isConfidential, date_created
, OurClient, TheirClient, ProjectName, DESCRIPTION, lawyer_lastname
, lawyer_firstname, Conflicts.ConflictID
FROM Hire_Response
, Conflicts
, Lawyers
WHERE Hire_Response.ConflictID = Conflicts.ConflictID
AND Lawyers.lawyerID = Conflicts.lawyerID
AND CHARINDEX(',' + CAST(firmID AS NVARCHAR) + ',',','+@FirmIDString + ',') >0
AND HireID = @HireID
AND isStillaConflict = 1
ORDER BY
file_number
, TheirClient
, OurClient
, lawyer_lastname
, lawyer_firstname
但是现在我根本没有得到任何记录(尽管代码似乎运行没有错误)。我知道我应该得到记录,因为如果我切换到非存储过程,我会得到记录。
有人知道这里出了什么问题吗?
【问题讨论】:
-
这段代码容易受到sql注入攻击。你实际上是在乞求被黑。
标签: sql sql-server sql-server-2005 select