我在try 修改我的SQL查询以处理有关潜在SQL注入的警告时遇到问题.我的目标是将查询参数化并使用原始字符串文字,但我收到了一条错误消息.

该错误似乎与我的列名的区分大小写有关,不幸的是,我不能将整个数据库更改为小写.

我已经try 过各种其他方法,但它们要么导致错误,要么无法正确检索用户ID.

下面是我试过的代码.

  1. 原始版本(SQL注入问题)
await dbContext.Database.ExecuteSqlRawAsync(
$@"
    DO $$ 
    BEGIN 
        IF (SELECT COUNT(*) FROM ""Notification"" WHERE ""UserId"" = '{userId}') > 20 THEN
            DELETE FROM ""Notification""
            WHERE ""UserId"" = '{userId}' AND ""IsReceived"" = 'TRUE' AND ""ContentId"" NOT IN (
                SELECT ""ContentId"" FROM ""Notification""
                WHERE ""UserId"" = '{userId}'
                ORDER BY ""CreatedAt"" DESC
                LIMIT 20
            );
        END IF;
    END $$"
);
  1. 原始字符串文字版本

(错误:Npgsql.PostgresException:42703:用户ID列不存在)

var param = new NpgsqlParameter("@UserId", userId);
await dbContext.Database.ExecuteSqlRawAsync(
"""
    DO $$ 
    BEGIN 
        IF (SELECT COUNT(*) FROM "Notification" WHERE "UserId" = @UserId) > 20 THEN
            DELETE FROM "Notification"
            WHERE "UserId" = @UserId AND "IsReceived" = 'TRUE' AND "ContentId" NOT IN (
                SELECT "ContentId" FROM "Notification"
                WHERE "UserId" = @UserId
                ORDER BY "CreatedAt" DESC
                LIMIT 20
            );
        END IF;
    END $$
""", param);
  1. 原始字符串文字版本 with ExecuteSqlInterpolatedAsync

(错误:Npgsql.PostgresException:42703:P0列不存在)

await dbContext.Database.ExecuteSqlInterpolatedAsync(
$"""
    DO $$ 
    BEGIN 
        IF (SELECT COUNT(*) FROM "Notification" WHERE "UserId" = {userId}) > 20 THEN
            DELETE FROM "Notification"
            WHERE "UserId" = {userId} AND "IsReceived" = 'TRUE' AND "ContentId" NOT IN (
                SELECT "ContentId" FROM "Notification"
                WHERE "UserId" = {userId}
                ORDER BY "CreatedAt" DESC
                LIMIT 20
            );
        END IF;
    END $$
""");

我希望得到关于进行修改的最佳方式的指导.

感谢您的帮助!

推荐答案

IF实际上不是必需的,所以你可以只使用普通的SqlInterpolated块(即完全参数化的).

await dbContext.Database.ExecuteSqlInterpolatedAsync(
$"""
    DELETE FROM "Notification"
    WHERE "UserId" = {userId}
      AND "IsReceived" = TRUE
      AND "ContentId" NOT IN (
          SELECT n2."ContentId"
          FROM "Notification" n2
          WHERE n2."UserId" = {userId}
          ORDER BY n2."CreatedAt" DESC
          LIMIT 20
      );
""");

Csharp相关问答推荐

在WPF.NET 6中使用C++/WinRT组件(但实际上是任何WinRT组件)

读取配置文件(mytest. exe. config)

C#方法从AJAX调用接收NULL

无法创建';';类型的';DbContext';.异常';无法解析类型';Microsoft.EntityFrameworkCore.DbContextOptions`1[Comm的服务

使用两个不同的枚举作为Switch语句中的CASE生成唯一值

使用C#HttpClient以多部分形式数据发送带有非ASCII文件名的文件的问题

如何在WPF的树视图中显示一个对象的两个或多个属性,其中只有一个是分层项?

如何在毛伊岛应用程序中完美地同步视图模型和视图的加载?

.NET SDK包中的官方C#编译器在哪里?

使用泛型可空类实现接口

该函数不能检测两条曲线的交点

.NET 8 DI GetServices<;对象&>不工作

委托RequestDelegate不带2个参数-ASP.NET Core 8最小API

升级后发出SWITCH语句

我什么时候应该在Dapper中使用Connection.OpenAsync?

C#Microsoft.CodeAnalysis.CSharp.Scriiting不等待并行.对于

使DefaultIfEmpty返回空

项目参考和方法签名问题

无法对包含字符串的列进行排序.请与实体框架联接

测试单个对象是否与Func<;T,bool>;匹配