【发布时间】:2015-10-27 15:38:44
【问题描述】:
我正在尝试创建一个按钮,用于在 MVC 项目中查找数据库中的值。读完一轮后我有点卡住了,所以可以用一些技巧来做。
创建的实际 cshmtl
odel OncologyRTA.Controllers.oncologyPatient
@{
ViewBag.Title = "Create";
}
<h2>Add new patient</h2>
@using (Html.BeginForm())
{
@Html.AntiForgeryToken()
<button type="button" name="button" value="find">Search</button>
<div class="form-horizontal">
<h4><font color="red"><strong>LIVE Dataset</strong></font></h4>
<hr />
@Html.ValidationSummary(true)
<dl class="dl-horizontal">
<dt>
@Html.LabelFor(model => model.HospitalID, new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.TextBoxFor(model => model.HospitalID, new { onkeyup = "InputToUpper(this);"})
@Html.ValidationMessageFor(model => model.HospitalID)
</dd>
<dt>
@Html.LabelFor(model => model.NHS_No_, "NHS No.", new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.EditorFor(model => model.NHS_No_)
@Html.ValidationMessageFor(model => model.NHS_No_)
</dd>
<dt>
@Html.LabelFor(model => model.Forename, new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.TextBoxFor(model => model.Forename, new { onkeyup = "InputToUpper(this);", Name="Forename"})
@Html.ValidationMessageFor(model => model.Forename)
</dd>
<dt>
@Html.LabelFor(model => model.Surname, new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.TextBoxFor(model => model.Surname, new { onkeyup = "InputToUpper(this);" })
@Html.ValidationMessageFor(model => model.Surname)
</dd>
<dt>
@Html.LabelFor(model => model.DOB, new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.TextBoxFor(model => model.DOB, new { @Value = "dd/MM/yyyy" })
@Html.ValidationMessageFor(model => model.DOB)
</dd>
<dt>
@Html.LabelFor(model => model.Active, new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.EditorFor(model => model.Active)
@Html.ValidationMessageFor(model => model.Active)
</dd>
<dt>
@Html.LabelFor(model => model.Deceased, new { @class = "control-label col-md-2" })
</dt>
<dd>
@Html.EditorFor(model => model.Deceased)
@Html.ValidationMessageFor(model => model.Deceased)
</dd>
</dl>
<div class="form-group">
<div class="col-md-offset-2 col-md-10">
<input type="submit" value="Create" class="btn btn-default" />
</div>
</div>
</div>
}
<script>
function InputToUpper(obj) {
if (obj.value != "") {
obj.value = obj.value.toUpperCase();
}
}
</script>
<script>
$("button[name='button']").click(function (event) {
event.preventDefault();
var uquery = $('#HospitalID').val();
var url = '@Url.Action("GetData")';
var data = { value: uquery }
$.ajax({
url: url,
data: data,
success: function (data) {
$('#Forename').val(data.HospitalID);
}
});
})
</script>
<div>
@Html.ActionLink("Back to List", "Index")
</div>
@section Scripts {
@Scripts.Render("~/bundles/jqueryval")
}
类的实际代码
> public class Lkup
> {
> public string HospitalID { get; set; }
> public string NHS_No_ { get; set; }
> public string Forename { get; set; }
> public string Surname { get; set; }
> public System.DateTime DOB { get; set; }
> }
控制器中的HttpGet代码
[HttpGet]
public JsonResult GetData(string value)
{
var result = new Lkup();
string connect = "Server=server\\instance;Database=SQLtable;Trusted_Connection=True";
string query = "select * from table1 where pkey =" +value;
using (SqlConnection sql1 = new SqlConnection(connect))
{
sql1.Open();
SqlCommand cmd = new SqlCommand(query);
SqlDataReader rdr = cmd.ExecuteReader();
{ if (rdr != null)
{
while (rdr.Read())
{
result.HospitalID = "column1";
result.Forename = "column2";
result.Surname = "colum3";
}
}
rdr.Close();
}
sql1.Close();
}
return Json(result, JsonRequestBehavior.AllowGet);
}
***** 更新 *****
我认为代码现在很好,我们已经测试了一些 javascript 警报,它们正在提取正确的字段和数据。问题似乎出在 ajax 调用中,因为它在尝试路由到控制器时得到 404。像这样:
GET http://localhost:59845/oncologyPatientsController/GetData?id=1234567 404 (Not Found)
send @ jquery-1.10.2.min.js:23
x.extend.ajax @ jquery-1.10.2.min.js:23
(anonymous function) @ Create:157
x.event.dispatch @ jquery-1.10.2.min.js:22
v.handle @ jquery-1.10.2.min.js:22
【问题讨论】:
-
string query = "SELECT val.1, val.2, val.3, val.4 FROM [SQL1\\INSTANCE].dB.dbo.tbl1 AS L INNER JOIN [SQL1\\INSTANCE].dB.dbo.SID AS S ON 1.ui = 2.ui WHERE val.1 = " +value;行已经适合 SQL 注入,这是一个严重的安全问题。以troyhunt.com/2010/05/… 为起点。 -
谢谢。我只是想先在那里获得功能,然后根据需要加强。
-
什么不起作用?为什么要添加
new { Name="HospitalID" }等? -name属性的值已经是HospitalID。$('Forename').val(data.HospitalID);不会做任何事情 - 它需要是$('#Forename').val(data.HospitalID); -
对不起,当我尝试不同的方法让它识别变量时,我一定是复制了一些代码。再次发布 cshtml,减去添加的“名称”属性和“#”前缀。按下时按钮会突出显示,但之后没有任何反应。
标签: jquery ajax asp.net-mvc model-view-controller linkbutton