开发者

Data conversion failed. Why?

Hello i recently got a problem in my Asp. Net C# 4 application. I am getting values from a开发者_如何学运维dress and then putting they into database. But framework give me "Data conversion failed. [ OLE DB status value (if known) = 2 ]" error. Here is my code:

var db = Database.Open("StarterSite");
var insert = db.Execute("INSERT INTO Downloads (ID, Name, Url, Size) VALUES ('@1', '@2', '@3', '@4')", Convert.ToInt32(Request.QueryString["fileid"]), Request.QueryString["name"], Request.QueryString["url"], Request.QueryString["size"]);

Where ID is int and Name, Url, Size is ntext. Please help me. Thanks!


The parameter markers that the Database helper accepts must start at 0

var db = Database.Open("StarterSite");
var insert = db.Execute("INSERT INTO Downloads (ID, Name, Url, Size) VALUES (@0, @1, @2, @3)", Request["fileid"], Request["name"], Request["url"], Request["size"]);


If the ID column is an integer then don't wrap the value in quotes:

'@1' should be @1

Note: What you have here is a SQL injection vulnerability. Never directly use query string input (or form input, or any user input) in a query like this. Look into parameterized queries, ORMs, etc. What you have here leaves your database wide open to attack.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜