使用命令参数的Web API不返回任何数据

Web API查询接收字符串数组的Oracle数据库作为输入参数。我试图使用命令参数来避免SqL注入，但下面的代码不会抛出任何错误，但不会给出结果。使用命令参数的Web API不返回任何数据

public class PDataController : ApiController 
{ 
    public HttpResponseMessage Getdetails([FromUri] string[] id) 
    { 

     List<OracleParameter> prms = new List<OracleParameter>(); 
     string connStr = ConfigurationManager.ConnectionStrings["PDataConn"].ConnectionString; 
     using (OracleConnection dbconn = new OracleConnection(connStr)) 
     { 
      var inconditions = id.Distinct().ToArray(); 
      var srtcon = string.Join(",", inconditions); 
      DataSet userDataset = new Dataset(); 
      var strQuer = @"SELECT STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, 
      STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, 
      Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, 
      STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME 
      FROM STCD_PRIO_CATEGORY_DESCR 
      WHERE STCD_PRIO_CATEGORY_DESCR.STD_REF("; 
      StringBuilder sb = new StringBuilder(strQuery); 
      for(int x = 0; x < inconditions.Length; x++) 
      { 
       sb.Append(":p" + x + ","); 
       OracleParameter p = new OracleParameter(":p" + x,OracleDbType.NVarchar2); 
       p.Value = inconditions[x]; 
       prms.Add(p); 
      } 
      if(sb.Length > 0) sb.Length--; 
      strQuery = strQuery + sb.ToString() + ")"; 
      using (OracleCommand selectCommand = new OracleCommand(strQuery, dbconn)) 
      { 
       selectCommand.Parameters.AddRange(prms.ToArray()); 
       using (OracleDataAdapter adapter = new OracleDataAdapter(selectCommand)) 
       { 
        DataTable selectResults = new DataTable(); 
        adapter.Fill(selectResults); 
        var returnObject = new { data = selectResults }; 
        var response = Request.CreateResponse(HttpStatusCode.OK, returnObject, MediaTypeHeaderValue.Parse("application/json")); 
        ContentDispositionHeaderValue contentDisposition = null; 
        if (ContentDispositionHeaderValue.TryParse("inline; filename=ProvantisStudyData.json", out contentDisposition)) 
        { 
         response.Content.Headers.ContentDisposition = contentDisposition; 
        } 
        return response; 
       } 
      } 

     } 
    } 
}

下面是同时的CommandText调试的SelectCommand

"SELECT \r\n STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, \r\n 
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, \r\n 
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, \r\n 
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME \r\n 
FROM \r\n 
STCD_PRIO_CATEGORY_DESCR \r\n 
WHERE \r\n 
STCD_PRIO_CATEGORY_DESCR.STD_REF IN(SELECT \r\n 
STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, \r\n 
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, \r\n 
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, \r\n 
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME \r\n 
FROM \r\n 
STCD_PRIO_CATEGORY_DESCR \r\n 
WHERE \r\n 
STCD_PRIO_CATEGORY_DESCR.STD_REF IN(:p0)"

的因为我给目前

strQuery = strQuery+ sb.ToString() + ")";

的选择被重复了我得到。但是，如果我只是给

strQuery = sb.ToString() + ")";

尽管strQuery而调试

SELECT \r\n STCD_PRIO_CATEGORY_DESCR.DESCR AS CATEGORY, \r\n 
STCD_PRIO_CATEGORY_DESCR.SESSION_NUM AS SESSION_NUMBER, \r\n 
Trunc(STCD_PRIO_CATEGORY_DESCR.START_DATE) AS SESSION_START_DATE, \r\n 
STCD_PRIO_CATEGORY_DESCR.START_DATE AS SESSION_START_TIME \r\n 
FROM \r\n 
STCD_PRIO_CATEGORY_DESCR \r\n 
WHERE \r\n 
STCD_PRIO_CATEGORY_DESCR.STD_REF IN(:p0)

我得到的回报是什么

{"data":[]}

我应该附上P0在'因为我们收到的输入是字符串数组。

但是，当我尝试在SQL开发人员的相同ID时，我正在获取记录。任何帮助是极大的赞赏。

来源

2016-08-04 user4912134

什么是你'id'参数？在执行它之前，生成的sql查询看起来如何？ – shirbr510

ID是我们在调用API时给出的字符串，如果我们将API称为http：// local host：80/API，则生成的查询应该类似于STCD中的Select *，其中STDREF IN（'a001'，'a002'）/PData？id ='a001'＆我会='a002' – user4912134

我知道。我要求一个GET请求的例子。例如：'http://example.com/api/somecontroller/getdetails?id=1&id=2&id=3&id=4' – shirbr510

从与OP的聊天中发现OP在数组参数ID周围添加了单引号。以这种方式格式化的查询字符串收到的值

http:// localhost:80/api/PData?id='JW217T_01'

并且这是尝试传递字符串作为参数值。

但是，如果您使用参数并指定其数据类型（NVarChar2），那么数据库引擎就会知道足够多的值来自行执行正确的引用，所以参数的值不应包含单引号。

更改查询字符串的格式

http:// localhost:80/api/PData?id=JW217T_01

固定的问题

来源

2016-08-04 12:42:48 Steve

使用命令参数的Web API不返回任何数据

回答

相关问题