【发布时间】:2013-02-06 04:47:10
【问题描述】:
当人们搜索我的网站时,我不想只搜索值 (q),我想用空格作为分隔符搜索每个单词。我已经编写了大部分代码,但有些部分我不知道该怎么做。
你能检查下面代码中的“todo”并建议我一个方法吗?或者也许是一种完全不同的方法。顺便说一句,如果可能的话,我想保留 SQL 代码部分,因为这对我来说更自然,但所有 TODO 都可以在 LINQ 中完成。
谢谢
代码如下:
[HttpPost]
public ActionResult Search(string q)
{
ViewBag.q = q;
String[] strQueries = q.Split(' ');
//TODO: Create an array of type var???
foreach (string str in strQueries)
{
var recipesTemp = db.Recipes.SqlQuery(
String.Format(
"SELECT * FROM Recipe WHERE Name LIKE '%{0}%' " +
"UNION ALL " +
"SELECT * FROM Recipe WHERE IDRecipe IN ( " +
" SELECT IDRecipe FROM Subtitle WHERE Name LIKE '%{0}%') " +
"UNION ALL " +
"SELECT * FROM Recipe WHERE IDRecipe IN ( " +
" SELECT IDRecipe FROM RecipeTag " +
" INNER JOIN Tag ON Tag.IDTag = RecipeTag.IDTag " +
" WHERE Name LIKE '%{0}%') " +
"UNION ALL " +
"SELECT * FROM Recipe WHERE IDRecipe IN ( " +
" SELECT IDRecipe FROM Subtitle " +
" INNER JOIN Ingredient ON Ingredient.IDSubtitle = Subtitle.IDSubtitle " +
" WHERE QuantityAndName LIKE '%{0}%')", str)).Distinct().OrderBy(r => r.Name).ToList();
//TODO: Add recipesTemp to the array of var
}
var recipes = //TODO: INTERSECT the results from all the recipesTemp in the array of type var
return View("Search", recipes);
}
【问题讨论】:
-
如果这里有“配方”,那就是SQL注入攻击。
-
除了安全问题,您是否知道如何做到这一点?在这种情况下,您建议如何避免 SQL 注入攻击?
标签: c# asp.net-mvc linq search entity-framework-4