在 ASP.Net Web 应用程序数据层中实现静态方法是否安全？

Question

我正在开发一个 Web 应用程序，它是一个 B2B 门户应用程序。我正在为我的应用程序遵循 2 层架构。 下面是一段将公司注册到我的网站的代码

/// <summary>
        /// Register Company with the business bazaar
        /// </summary>
        /// <param name="registration"></param>
        /// <returns></returns>
        public static bool RegisterCompany(Registration registration)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_RegisterCompany";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter("@Name",registration.RegisteredUser.Name),
                                        new SqlParameter("@Designation",registration.Designation ),
                                        new SqlParameter("@Email",registration.RegisteredUser.Email ),
                                        new SqlParameter("@AltEmail",registration.RegisteredUser.AlternateEmail ),
                                        new SqlParameter("@City",registration.City ),
                                        new SqlParameter("@State",registration.State ),
                                        new SqlParameter("@Country",registration.Country ), 
                                        new SqlParameter("@Telephone",registration.Telephone ),
                                        new SqlParameter("@Mobile",registration.Mobile ),
                                        new SqlParameter("@CompanyName",registration.CompanyName ),
                                        new SqlParameter("@Website",registration.Website ),
                                        new SqlParameter("@LoginId",registration.RegisteredUser.UserName ),
                                        new SqlParameter("@Password",registration.RegisteredUser.Password ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool) success.Value;
            }
            return result;

        }

我想说的是，我对所有数据层方法都使用了静态方法。正如我在网上浏览的各种文章一样，静态方法比非静态方法具有更多优势。所以我以这种方式设计了我的代码。但是几天前我看到一篇文章说静态方法在你为你的类设计一些实用程序时很有用，否则明智地使用非静态，因为其他用户也可以使用相同的静态对象。所以我只是想弄清楚要遵循哪种方法，静态的还是非静态的。

我正在使用这种格式的课程：

public sealed class MyClass
{
    private MyClass(){}
    public static DataTable GetUserInfoByUserId(int userId)
    {
       // My datalayer code goes here
    }
}

所以如果将上述方法设为静态，我会感到困惑，不会让用户 1 的数据对同时访问应用程序的用户 2 可用。基本上，我想知道这个设计的缺陷。

更新 下面是我的课，展示我的方法

#region

using System.Data;
using System.Data.SqlClient;
using System;

#endregion

namespace InnovativeTechnosoft.BusinessBazaar.Core
{
    public sealed class UserData
    {
        private static string _commandText = string.Empty;


        /// <summary>
        /// Takes username and password as input and sets 
        /// the current user in sessionif the user authenticate
        /// successfully
        /// </summary>
        /// <param name="userName">username as string</param>
        /// <param name="password">password as string</param>
        /// <returns>datatable</returns>
        public static DataTable IsAuthenticated(string userName, string password)
        {
            DataTable dtResult;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_AuthenticateUsers";
                var parameters = new[]
                                     {
                                         new SqlParameter("@username", userName),
                                         new SqlParameter("@password", password),
                                     };
                dtResult = helper.ExecuteSelect(_commandText, CommandType.StoredProcedure, parameters);
            }

            return dtResult;
        }

        /// <summary>
        /// Checks for username if it exists or not
        /// </summary>
        /// <param name="userName"></param>
        /// <returns></returns>
        public static bool IsExistingUser(string userName)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_IsExistingUserName";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                              "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter("@userName", userName),
                                         success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool)success.Value;
            }

            return result;
        }

        /// <summary>
        /// Register Company with the business bazaar
        /// </summary>
        /// <param name="registration"></param>
        /// <returns></returns>
        public static bool RegisterCompany(Registration registration)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_RegisterCompany";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter("@Name",registration.RegisteredUser.Name),
                                        new SqlParameter("@Designation",registration.Designation ),
                                        new SqlParameter("@Email",registration.RegisteredUser.Email ),
                                        new SqlParameter("@AltEmail",registration.RegisteredUser.AlternateEmail ),
                                        new SqlParameter("@City",registration.City ),
                                        new SqlParameter("@State",registration.State ),
                                        new SqlParameter("@Country",registration.Country ), 
                                        new SqlParameter("@Telephone",registration.Telephone ),
                                        new SqlParameter("@Mobile",registration.Mobile ),
                                        new SqlParameter("@CompanyName",registration.CompanyName ),
                                        new SqlParameter("@Website",registration.Website ),
                                        new SqlParameter("@LoginId",registration.RegisteredUser.UserName ),
                                        new SqlParameter("@Password",registration.RegisteredUser.Password ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool) success.Value;
            }
            return result;

        }

        /// <summary>
        /// Recovers Password 
        /// </summary>
        /// <param name="email"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static bool RecoverPassword(string email, out string password)
        {
            bool result;
            password = string.Empty;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_RecoverPassword";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var pwd = new SqlParameter("@Password", SqlDbType.NVarChar, 50, ParameterDirection.Output, true, 0, 0, "Password", DataRowVersion.Default, string.Empty);
                var parameters = new[]
                                     {
                                        new SqlParameter("@Email",email ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool)success.Value;
                password = Convert.ToString(pwd.Value);
            }
            return result;
        }
        /// <summary>
        /// Update  Password 
        /// </summary>
        /// <param name="email"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static bool UpdatePassword(int userId,string password)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_UpdatePassword";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter ("@UserId",userId),
                                        new SqlParameter("@Password",password ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool)success.Value;
            }
            return result;
        }

    }
}

这将是一个很大的帮助。

问候 阿米特·兰詹

Answer 1

使您的方法实例化而不是静态可能会帮助您进行后续维护。例如，在某些情况下，您可能希望能够替换 DBHelper 类的不同实现。

现在，由于您的静态方法调用var helper = new DbHelper()，因此您只能使用该实例。但是，假设您要编写一些单元测试，这些单元测试使用连接到不同数据库的不同 DbHelper 类。你最好上一门课：

    public class DataLayer {
        public DataLayer(IDbHelper dbHelper){
            this.DbHelper = dbHelper;
        }
        public IDbHelper DbHelper { get; private set; }

        public void RunQuery(){
            // Do stuff with dbhelper
        }
    }

现在您可以在不同情况下传入不同的 DbHelper。

Answer 2

您可以使用静态函数，但您应该完全避免使用静态变量或成员。简而言之，不要在静态上下文中“保存”任何信息。这些在应用程序范围内可用，并且对于来自不同用户的不同请求可能是相同的。

在静态函数中运行数据访问操作应该没问题。