oledb for vfp错误：当在web服务器上运行asp.net时无效的路径或文件名

Question

我开发Web应用程序asp.net连接到Visual Fox Pro数据库免费表（.dbf）与Microsoft Oledb for visualfoxpro驱动程序。 当我开发连接时运行与vs2013程序正常工作。 但是当我的网站上的Web服务器上运行它无法搜索或连接到数据库，VFP和 我得到这个错误：无效的路径或文件名

这是我的代码来连接数据库VFP。

Try 
      'if use visual fox pro Connect to a single DBF-file 
      ConnectionString = "Provider=vfpoledb;Data Source=//database/event/event/OPD/OUT.DBF;sourcetype=DBF;exclusive=No;Collating Sequence=machine; User ID=stat1;Password = stat1;" 
      dBaseConnection = New OleDb.OleDbConnection(ConnectionString) 
      dBaseConnection.Open() 

      sCommand = "SELECT lastdate,save_id,count(*) AS Tcoder FROM OUT.DBF WHERE lastdate BETWEEN CTOD('" & TextBox1.Text & "') and CTOD('" & TextBox2.Text & "') AND typeevent LIKE '%" & TextBox3.Text & "%' " 
      sCommand &= "AND lasttime >= '" & ddlFromTime.SelectedValue & "' AND lasttime <= '" & ddlToTime.SelectedValue & "' GROUP BY lastdate,save_id ORDER BY Tcoder DESC " 
      dBaseCommand = New OleDb.OleDbCommand(sCommand, dBaseConnection) 
      ' 
      Dim dt As DataTable = GetData(dBaseCommand) 
      GridView1.DataSource = dt 
      GridView1.DataBind() 
      ' 
      dBaseConnection.Close() 
     Catch ex As OleDb.OleDbException 
      Response.Write("Error: " + ex.Message) 
     End Try 

如何解决这个问题？预先感谢。 -/-

Answer 1

首先，您的连接字符串应该只指向表所在的PATH而不是.dbf文件的实际名称。然后，您可以从位于连接路径中的ANY.dbf进行查询。

其次，在构建查询时，AVOID SQL注入因为您现在通过字符串连接而广泛打开。为了防止，VFP使用“？”作为参数的占位符，参数需要按照它们在查询中出现的顺序添加。

ConnectionString = "Provider=vfpoledb;Data Source=//database/event/event/OPD;sourcetype=DBF;exclusive=No;Collating Sequence=machine; User ID=stat1;Password = stat1;" 
dBaseConnection = New OleDb.OleDbConnection(ConnectionString) 
dBaseConnection.Open() 

' Notice all the "?" place-holders for the parameters. 
sCommand = 
    @"SELECT lastdate, save_id, count(*) AS Tcoder  
     FROM OUT.DBF 
     WHERE BETWEEN(lastdate, ?, ?) 
      AND typeevent LIKE ? 
      AND lasttime >= ? 
      AND lasttime <= ? 
     GROUP BY 
      lastdate, 
      save_id 
     ORDER BY 
      Tcoder DESC "; 

' get the command instance 
dBaseCommand = New OleDb.OleDbCommand(sCommand, dBaseConnection) 
' NOW, add the parameters IN ORDER as they appear... starting with the dates 

' but you will have to convert the ".Text" values to a date field in VB.net 
' first, then the date-based field will be properly recognized in the VFP call. Sorry not fluent in VB to convert, but you should be able to get that. 
dBaseCommand.Parameters.AddWithValue("parmFromDate", TextBox1.Text); 
dBaseCommand.Parameters.AddWithValue("parmFromDate", TextBox2.Text); 

' now for the "TypeEvent" criteria, no wrapping the text within quotes 
' as the query knows it is a string, so don't explicitly add quotes. 
dBaseCommand.Parameters.AddWithValue("parmTypeEvent", "%"+ TextBox3.Text +"%"); 

' It appears your LASTTIME field are string-based, so no conversion 
' just strings like other. 
dBaseCommand.Parameters.AddWithValue("parmTime1", ddlFromTime.SelectedValue); 
dBaseCommand.Parameters.AddWithValue("parmTime2", ddlToTime.SelectedValue); 

' Now, finish getting the data and setting the Data source to the result 
Dim dt As DataTable = GetData(dBaseCommand) 
GridView1.DataSource = dt 
GridView1.DataBind() 

dBaseConnection.Close()