使用EXEC来创建存储过程在SQL Server中运行更新字符串列2008

Question

我有我的存储过程的以下修改：

SET ANSI_NULLS ON 
GO 
SET QUOTED_IDENTIFIER ON 
GO 

ALTER PROCEDURE [dbo].[spTMSA_Test_Run] 
    @TableName nvarchar(200) = 'MyTable', 
    @Parent int = 1145, 
    @Name nvarchar(100) = '''Test''', 
    @KPI nvarchar(max) = '''Test''', 
    @IDCount int = 1137 
AS 
BEGIN 
    EXEC('UPDATE ' + @TableName + ' SET Parent = ' + @Parent + ', Name = ' + @Name + ' , KPI = ' + @KPI + ' WHERE IDCount = ' + @IDCount) 
END 

，如果我前后给了“””这个过程被成功执行字符串值。如果我离开'字符串值之前和之后它会导致错误。

请帮我找出原因和解决方法。谢谢

Answer 1

此程序是SQL injection攻击的开门。 除非你有一个非常好的理由，为什么你需要它来创建动态SQL，我会建议避免它。

如果您无法避免使用动态sql，您至少可以使用quotename来保证您的过程更安全一些。

至于你在你的问题说明问题 - 只要将'''到查询体：

SET ANSI_NULLS ON 
GO 
SET QUOTED_IDENTIFIER ON 
GO 

ALTER PROCEDURE [dbo].[spTMSA_Test_Run] 
    @TableName nvarchar(200) = 'MyTable', 
    @Parent int = 1145, 
    @Name nvarchar(100) = 'Test', 
    @KPI nvarchar(max) = 'Test', 
    @IDCount int = 1137 
AS 
BEGIN 

    EXEC('UPDATE QUOTENAME(' + @TableName + ') 
      SET Parent = ' + @Parent + ', 
       Name = ''' + @Name + ''' , 
       KPI = ''' + @KPI + ''' 
      WHERE IDCount = ' + @IDCount) 
END 

Answer 2

SET ANSI_NULLS ON 
GO 
SET QUOTED_IDENTIFIER ON 
GO 

ALTER PROCEDURE [dbo].[spTMSA_Test_Run] 
    @TableName nvarchar(200) = 'MyTable', 
    @Parent int = 1145, 
    @Name nvarchar(100) = '''Test''', 
    @KPI nvarchar(max) = '''Test''', 
    @IDCount int = 1137 
AS 
BEGIN 

　　declare @sql nvarchar(4000) 
　　set @sql='UPDATE ' + @TableName + ' SET Parent = ' + @Parent + ', Name = ' + @Name + ' , KPI = ' + @KPI + ' WHERE IDCount = ' + @IDCount 
　　print @sql --find reason in the sql statement 
    EXEC(@sql) 
END 

Answer 3

我建议使用sp_executesql和CAST int到nvarchar执行查询之前和QUOTENAME的@tablename 。

SET ANSI_NULLS ON 
GO 
SET QUOTED_IDENTIFIER ON 
GO 

ALTER PROCEDURE [dbo].[spTMSA_Test_Run] 
    @TableName nvarchar(200), 
    @Parent int, 
    @Name nvarchar(100), 
    @KPI nvarchar(max), 
    @IDCount int 
AS 
BEGIN 

    DECLARE @sql nvarchar(max) 

    SELECT @sql = ' 
     UPDATE ' + QUOTENAME(@TableName) + ' 
     SET Parent = ' + CAST(@Parent as nvarchar(10))+ ', 
      Name = ''' + @Name + ''', 
      KPI = ''' + @KPI + ''' 
     WHERE IDCount = ' + CAST(@IDCount as nvarchar(10)) + ';' 


    EXEC sp_executesql @sql 

END