优化数据库链接

UAS_MES_YDCY/DataOperate/DataHelper.cs

@@ -104,6 +104,21 @@ namespace UAS_MES_NEW.DataOperate
             }
         }
 
+        /// <summary>
+        /// 获取第一行第一列的信息(参数化版,防SQL注入)
+        /// where 中使用 :p0,:p1 占位符,values 按占位符出现顺序传入
+        /// </summary>
+        public object getFieldDataByCondition(string TableName, string Field, string whereWithPlaceholders, params object[] values)
+        {
+            string sql = "select " + Field + " from " + TableName + " where " + whereWithPlaceholders;
+            DataTable dt = (DataTable)ExecuteSql(sql, "select", values);
+            if (dt != null && dt.Rows.Count > 0)
+            {
+                return dt.Rows[0][0];
+            }
+            return "";
+        }
+
         /// <summary>
         /// 执行打印的SQL
         /// </summary>
@@ -206,6 +221,16 @@ namespace UAS_MES_NEW.DataOperate
             return dt;
         }
 
+        /// <summary>
+        /// 通过表名和获取单行的记录(参数化版,防SQL注入)
+        /// where 中使用 :p0,:p1 占位符,values 按占位符出现顺序传入
+        /// </summary>
+        public DataTable getFieldsDataByCondition(string TableName, string[] Fields, string whereWithPlaceholders, params object[] values)
+        {
+            string sql = "select " + AddField(Fields) + " from " + TableName + " where " + whereWithPlaceholders;
+            return (DataTable)ExecuteSql(sql, "select", values);
+        }
+
         /// <summary>
         /// 将DataTable导入到指定的表中
         /// </summary>

UAS_MES_YDCY/Login.cs

@@ -148,8 +148,8 @@ namespace UAS_MES_NEW
         {
             //设置全局用户信息
             string[] field = { "em_code,em_depart,em_type,em_name,em_position,em_professname,em_type,ug_code,ug_name" };
-            UserInf = dh.getFieldsDataByCondition("Employee left join cs$userresource on ur_emcode=em_code left join cs$usergroup on ug_code=ur_groupcode", field, "upper(em_code)='" + UserName.Text.ToUpper() + "' or em_mobile='" + UserName.Text.ToUpper() + "'");
-            DataTable dt = dh.getFieldsDataByCondition("source left join step on sc_stepcode=st_code left join line on sc_linecode=li_code", new string[] { "st_badgroupcode", "sc_wccode", "sc_code", "sc_stepcode", "sc_stepname", "sc_linecode", "LI_UPPERLINE" }, "upper(sc_code)='" + Source.Text.ToUpper() + "'");
+            UserInf = dh.getFieldsDataByCondition("Employee left join cs$userresource on ur_emcode=em_code left join cs$usergroup on ug_code=ur_groupcode", field, "upper(em_code)=:p0 or em_mobile=:p1", UserName.Text.ToUpper(), UserName.Text.ToUpper());
+            DataTable dt = dh.getFieldsDataByCondition("source left join step on sc_stepcode=st_code left join line on sc_linecode=li_code", new string[] { "st_badgroupcode", "sc_wccode", "sc_code", "sc_stepcode", "sc_stepname", "sc_linecode", "LI_UPPERLINE" }, "upper(sc_code)=:p0", Source.Text.ToUpper());
             //存在岗位资源则要求添加
             if (dt.Rows.Count > 0)
             {
@@ -283,7 +283,7 @@ namespace UAS_MES_NEW
 
         private void PassWord_TextChanged(object sender, EventArgs e)
         {
-            if (dh.getFieldDataByCondition("employee", "nvl(em_changesource,0)", "em_code='" + UserName.Text + "' and em_password='" + PassWord.Text + "'").ToString() != "0")
+            if (dh.getFieldDataByCondition("employee", "nvl(em_changesource,0)", "em_code=:p0 and em_password=:p1", UserName.Text, PassWord.Text).ToString() != "0")
             {
                 Source.Enabled = true;
             }

UAS_MES_YDCY/PublicMethod/BaseUtil.cs

@@ -1446,6 +1446,12 @@ namespace UAS_MES_NEW.PublicMethod
         /// <returns></returns>
         public static bool connectState(string path, string userName, string passWord)
         {
+            //命令注入防护:校验输入不含 shell 元字符(& | ; > < 等),拒绝危险输入
+            if (ContainsShellMetachar(path) || ContainsShellMetachar(userName) || ContainsShellMetachar(passWord))
+            {
+                LogManager.DoLog("connectState 拒绝含非法字符的输入: path=" + path);
+                return false;
+            }
             bool Flag = false;
             Process proc = new Process();
             try
@@ -1487,6 +1493,13 @@ namespace UAS_MES_NEW.PublicMethod
             return Flag;
         }
 
+        /// <summary>检测字符串是否含 shell 元字符,防止通过 cmd.exe 注入命令</summary>
+        private static bool ContainsShellMetachar(string input)
+        {
+            if (string.IsNullOrEmpty(input)) return false;
+            return input.IndexOfAny(new char[] { '&', '|', ';', '>', '<', '%', '^', '(', ')', '`', '"' }) >= 0;
+        }
+
         /// <summary>
         /// 向远程文件夹保存本地内容，或者从远程文件夹下载文件到本地
         /// </summary>