Dapper 和 SQL 注入 [英] Dapper and SQL Injections

问题描述

Dapper 如何帮助防止 SQL 注入?我正在测试不同的 DAL 技术，必须选择一种技术来保护我们的网站.我倾向于 Dapper (http://code.google.com/p/dapper-dot-net/)，但需要一些帮助来了解安全性.

How does Dapper help protect against SQL injections? I am testing out different DAL technologies and have to choose one to be secure our site. I'm leaning towards Dapper (http://code.google.com/p/dapper-dot-net/), but need some help learning about security.

推荐答案

Dapper 如何帮助防止 SQL 注入?

How does Dapper help protect against SQL injections?

它真的，真的很容易进行完全参数化的数据访问，而无需连接输入.特别是，因为你不需要跳过很多添加参数，设置参数类型，检查空值因为ADO.NET有糟糕的空处理，冲洗/重复20个参数"，通过使参数处理愚蠢方便.它还使将行转换为对象变得非常容易，避免使用 DataTable 的诱惑......每个人都赢了.

It makes it really, really easy to do fully parameterized data access, without ever needing to either concatenate input. In particular, because you don't need to jump through lots of "add parameter, set the parameter type, check for null because ADO.NET has sucky null-handling, rinse/repeat for 20 parameters", by making parameter handling stupidly convenient. It also makes turning rows into objects really easy, avoiding the temptation to use DataTable... everyone wins.

来自评论:

还有一个……那么 dapper 实际上有什么帮助?

One more...what does dapper actually help do then?

为了回答，让我们以marc_s的回复为例，按照旧的方式写，假设我们必须从connection开始.这是:

To answer, let's take the example from marc_s's reply, and write it the old way, assuming all we have to start with is connection. This is then:

List<Dog> dogs = new List<Dog>();
using(var cmd = connection.CreateCommand()) {
    cmd.CommandText = "select Age = @Age, Id = @Id";
    cmd.Parameters.AddWithValue("Age", DBNull.Value);
    cmd.Parameters.AddWithValue("Id", guid);
    using(var reader = cmd.ExecuteReader()) {
        while(reader.Read()) {
            int age = reader.ReadInt32("Age");
            int id = reader.ReadInt32("Id");
            dogs.Add(new Dog { Age = age, Id = id });
        }
        while(reader.NextResult()) {}
    }
}

除了我过于简单粗暴，因为它也处理广泛的问题，例如:

except I've over-simplfied grossly, as it also deals with a wide range of issues such as:

• 参数的空处理
• 结果列的空处理
• 使用序数列索引
• 适应底层表和类型的结构变化
• 结果列的数据转换(在各种原语、字符串、枚举等之间)
• 对非常常见的在此列表中"场景的特殊处理
• 对于执行"，将其单独应用于输入列表"的特殊处理
• 避免愚蠢的错别字
• 减少代码维护
• 处理多个网格
• 处理单个网格中水平返回的多个对象
• 使用任意 ADO.NET 提供程序(提示:AddWithValue 很少存在)
  • 包括对 Oracle 等需要额外配置的特定支持
  • 与迷你分析器"等 ​​ADO.NET 装饰器配合得很好

  这篇关于Dapper 和 SQL 注入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！