SQL 工具类

ExpandedBlockStart.gif 代码
using  System;
using  System.Data;
using  System.Configuration;
using  System.Web;
using  System.Web.Security;
using  System.Web.UI;
using  System.Web.UI.HtmlControls;
using  System.Web.UI.WebControls;
using  System.Web.UI.WebControls.WebParts;
using  System.Data.SqlClient;

///   <summary>
/// sql Server 数据库操作
///   </summary>
public   class  CMS_SqlHelp
{
   
private   static   string  sqlconstr  =  Convert.ToString(ConfigurationManager.ConnectionStrings[ " sqlconstr " ]);
    
public  CMS_SqlHelp()
    {
        
//
        
// TODO: 在此处添加构造函数逻辑
        
//
       
    }
    
///   <summary>
    
///  自定义分页
    
///   </summary>
    
///   <param name="tblName"> 表名 </param>
    
///   <param name="strGetFields"> 需要返回的列 </param>
    
///   <param name="fldName"> 排序字段名 </param>
    
///   <param name="PageSize"> 每页显示的条数 </param>
    
///   <param name="PageIndex"> 页码 </param>
    
///   <param name="doCount"> 返回记录总数,非0值则返回 </param>
    
///   <param name="OrderType"> 设置排序类型,非0值则降序 </param>
    
///   <param name="strWhere"> 查询条件,不加where </param>
    
///   <returns> datatable </returns>
     public   static  DataTable GetData( string  tblName,  string  strGetFields,  string  fldName,  int  PageSize,  int  PageIndex,  int  doCount,  int  OrderType,  string  strWhere)
    {
        
string  strSQL  =   "" , strTmp  =   "" , strOrder  =   "" ;
        
if  (doCount  !=   0 )
        {
            
if  (strWhere  !=   "" )
            {
                strSQL 
=   " select count(*) as Total from  "   +  tblName  +   "  where  "   +  strWhere;
            }
            
else
            {
                strSQL 
=   " select count(*) as Total from  "   +  tblName;
            }
        }
        
else
        {
            
if  (OrderType  !=   0 )
            {
                strTmp 
=   " <(select min " ;
                strOrder 
=   "  order by  "   +  fldName  +   "  desc " ;
            }
            
else
            {
                strTmp 
=   " >(select max " ;
                strOrder 
=   "  order by  "   +  fldName  +   "  asc " ;
            }
            
if  (PageIndex  ==   1 )
            {
                
if  (strWhere  !=   "" )
                {
                    strSQL 
=   " select top  "   +  PageSize  +   "   "   +  strGetFields  +   "  from  "   +  tblName  +   "  where  "   +  strWhere  +   "   "   +  strOrder;
                }
                
else
                {
                    strSQL 
=   " select top  "   +  PageSize  +   "   "   +  strGetFields  +   "  from  "   +  tblName  +   "   "   +  strOrder;
                }
            }
            
else
            {
                
if  (strWhere  !=   "" )
                {
                    strSQL 
=   " select top  "   +  PageSize  +   "   "   +  strGetFields  +   "   from  "   +  tblName  +   "  where  "   +  fldName  +   "   "   +  strTmp  +   " ( "   +  fldName  +   " ) from (select top  "   +  (PageIndex  -   1 *  PageSize  +   "   "   +  fldName  +   "  from  "   +  tblName  +   "  where  "   +  strWhere  +   "   "   +  strOrder  +   " ) as tblTmp) and  "   +  strWhere  +   "   "   +  strOrder;
                }
                
else
                {
                    strSQL 
=   " select top  "   +  PageSize  +   "   "   +  strGetFields  +   "   from  "   +  tblName  +   "  where  "   +  fldName  +   "   "   +  strTmp  +   " ( "   +  fldName  +   " ) from (select top  "   +  (PageIndex  -   1 *  PageSize  +   "   "   +  fldName  +   "  from  "   +  tblName  +   ""   +  strOrder  +   " ) as tblTmp) "   +  strOrder;
                }
            }
        }
        DataTable dt 
=  CMS_SqlHelp.getDataTable(strSQL);
        
return  dt;
    }
///   <summary>
///  执行无返回的SQL语句
///   </summary>
///   <param name="sqlStr"> SQL语句 </param>
///   <returns></returns>
     public   static   bool  ExcuteSqlServer( string  sqlStr)
    {
        SqlConnection con 
=   new  SqlConnection(sqlconstr);
        SqlCommand sqlcom 
=   new  SqlCommand();
        sqlcom.Connection 
=  con;
        sqlcom.CommandText 
=  sqlStr;
        con.Open();
        
try
        {
            sqlcom.ExecuteNonQuery();
       

            
return   true ;
        }
        
catch  (Exception ex)
        {
           
            errorCollecting.getError(ex);
            
return   false ;
        }
        
finally  {
            con.Close();
        }
    }
    
#region  ExecuteScalar
    
///   <summary>
    
///  返回所查结果第一列第一行
    
///   </summary>
    
///   <param name="sqlStr"></param>
    
///   <returns></returns>
     public   static   object  ExecuteScalar( string  sqlStr)
    {
        SqlConnection con 
=   new  SqlConnection(sqlconstr);
        SqlCommand sqlcom 
=   new  SqlCommand();
        sqlcom.Connection 
=  con;
        sqlcom.CommandText 
=  sqlStr;
        
object  obj  =   null ;
        con.Open();
        
try
        {
         obj
=   sqlcom.ExecuteScalar();
         
return  obj;

           
        }
        
catch  (Exception ex)
        {

            errorCollecting.getError(ex);
            
return   false ;
        }
        
finally
        {
            con.Close();
        }
    }
    
#endregion
    
public   static  SqlDataReader ExcuteSqlDataReader( string  sqlStr)
    {
        SqlConnection con 
=   new  SqlConnection(sqlconstr);
        SqlCommand sqlcom 
=   new  SqlCommand();
      
        sqlcom.Connection 
=  con;
        sqlcom.CommandText 
=  sqlStr;
        SqlDataReader sdr 
=   null ;
             con.Open();
             sdr 
=  sqlcom.ExecuteReader(CommandBehavior.CloseConnection);
            
return  sdr;
    
            
         
    }
    
///   <summary>
    
///  返回DaTable
    
///   </summary>
    
///   <param name="sqlStr"></param>
    
///   <returns></returns>
     public   static  DataTable getDataTable( string  sqlStr)
    {
        SqlConnection con 
=   new  SqlConnection(sqlconstr);
  

      
    

        DataTable dt 
=   new  DataTable();
        con.Open();
        
try
        {
            SqlDataAdapter da 
=   new  SqlDataAdapter(sqlStr, con);
            da.Fill(dt);
        }
        
catch  (Exception e)
        {
            errorCollecting.getError(e);
        }
        
finally
        {
            con.Close();
        }
        
return  dt;
    }


    
#region    ExcuteProc
    
///   <summary>
    
///  执行无返回值Proc
    
///   </summary>
    
///   <param name="sqlProc"></param>
     public   static   void  ExecuteProcedureNonQurey( string  sqlProc)
    {
        SqlConnection con 
=   new  SqlConnection(sqlconstr);

        SqlCommand com 
=   new  SqlCommand();
        com.Connection 
=  con;
        com.CommandText 
=  sqlProc;
        com.CommandType 
=  CommandType.StoredProcedure;

        con.Open();
        
try
        {
            com.ExecuteNonQuery();
            com.Dispose();

        }
        
catch  (Exception ex)
        {
            errorCollecting.getError(ex);
        }
        
finally
        {
            con.Close();

        }
    }

    
#endregion
    
///   <summary>
    
///  执行存储过程,不返回任何值
    
///   </summary>
    
///   <param name="storedProcedureName"> 存储过程名 </param>
    
///   <param name="parameters"> 参数 </param>
     /*
       SqlParameter sp = new SqlParameter("@job_desc", SqlDbType.VarChar, 50);
        SqlParameter sp2 = new SqlParameter("@job_id",SqlDbType.SmallInt);

        IDataParameter[] Idp = new IDataParameter[]{sp,sp2 };
        Idp[0].Value="adff";
        Idp[1].Value=6;
        CMS_sqlProc.ExecuteProcedureNonQurey("updateMy", Idp);
   
     
*/
    
public   static   void  ExecuteProcedureNonQurey( string  storedProcedureName, IDataParameter[] parameters)
    {
        SqlConnection connection 
=   new  SqlConnection(sqlconstr);
        SqlCommand command 
=   new  SqlCommand(storedProcedureName, connection);
        command.CommandType 
=  CommandType.StoredProcedure;
        
if  (parameters  !=   null )
        {
            
foreach  (SqlParameter parameter  in  parameters)
            {
                command.Parameters.Add(parameter);
            }
        }
        connection.Open();
        
try
        {
            command.ExecuteNonQuery();
            connection.Close();
        }
        
catch  (Exception ex)
        {
            errorCollecting.getError(ex);
        }


    }

    
///   <summary>
    
///  执行存储,并返回SqlDataReader
    
///   </summary>
    
///   <param name="storedProcedureName"> 存储过程名 </param>
    
///   <param name="parameters"> 参数 </param>
    
///   <returns> 包含查询结果的SqlDataReader </returns>
     public   static  SqlDataReader ExecuteProcedureReader( string  storedProcedureName, IDataParameter[] parameters)
    {
        SqlConnection connection 
=   new  SqlConnection(sqlconstr);
        SqlCommand command 
=   new  SqlCommand(storedProcedureName, connection);
        command.CommandType 
=  CommandType.StoredProcedure;
        
if  (parameters  !=   null )
        {
            
foreach  (SqlParameter parameter  in  parameters)
            {
                command.Parameters.Add(parameter);
            }
        }
        connection.Open();
        SqlDataReader sqlReader 
=  command.ExecuteReader(CommandBehavior.CloseConnection);
        
return  sqlReader;
    }

    
///   <summary>
    
///  执行存储,并返回DataTable
    
///   </summary>
    
///   <param name="storedProcedureName"> 存储过程名 </param>
    
///   <param name="parameters"> 参数 </param>
    
///   <returns> 包含查询结果的SqlDataReader </returns>
     public   static  DataTable ExecuteProcedureDataTable( string  storedProcedureName, IDataParameter[] parameters)
    {
        SqlConnection connection 
=   new  SqlConnection(sqlconstr);
        SqlCommand command 
=   new  SqlCommand(storedProcedureName, connection);
        command.CommandType 
=  CommandType.StoredProcedure;
        
if  (parameters  !=   null )
        {
            
foreach  (SqlParameter parameter  in  parameters)
            {
                command.Parameters.Add(parameter);
            }
        }
        connection.Open();


          DataTable dt 
=   new  DataTable();
        
try
        {
            SqlDataAdapter da 
=   new  SqlDataAdapter(command);
            da.Fill(dt);
        }
        
catch  (Exception e)
        {
            
throw  e;
        }
        
finally
        {
            connection.Close();
        }
        
return  dt;


    }

//可以尽量避免sqlconnection.open()操作
    
public   static  DataSet ExecuteProcedureDataset( string  storedProcedureName, IDataParameter[] parameters)
    {
        SqlConnection connection 
=   new  SqlConnection(sqlconstr);
        SqlCommand command 
=   new  SqlCommand(storedProcedureName, connection);
        command.CommandType 
=  CommandType.StoredProcedure;
        
if  (parameters  !=   null )
        {
            
foreach  (SqlParameter parameter  in  parameters)
            {
                command.Parameters.Add(parameter);
            }
        }
        connection.Open();

        DataSet ds 
=   new  DataSet();
        DataTable dt 
=   new  DataTable();
        
try
        {
            SqlDataAdapter da 
=   new  SqlDataAdapter(command);
       
            da.Fill(ds);
        }
        
catch  (Exception e)
        {
            
throw  e;
        }
        
finally
        {
            connection.Close();
        }
        
return  ds;


    }

 

 

 

转载于:https://www.cnblogs.com/rhythmK/archive/2009/12/13/1622854.html

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
package com.hexiang.utils; /** * SQLUtils utils = new SQLUtils(User.class); utils.setWhereStr("", "id", "=", 100).setWhereStr("and", "name", " ", "is null").setWhereStr("and", "date", ">=", new Date()); utils.setOrderByStr("id", "desc").setOrderByStr("name", "asc"); System.out.println(utils.buildSelectSQL()); System.out.println(utils.buildCountSQL()); */ import java.sql.Timestamp; import java.text.SimpleDateFormat; import java.util.Date; import java.util.LinkedHashMap; import java.util.LinkedList; import java.util.List; import java.util.Map; public class SqlUtils { private String beanName; private String beanShortName; private Map propertyMap; private List conditionList; private List relationList; private Map orderByMap; public SqlUtils(Class instance) { this.setBeanName(instance.getSimpleName()); this.setBeanShortName(Character.toLowerCase(this.getBeanName() .charAt(0)) + ""); init(); } public SqlUtils() { init(); } void init(){ propertyMap = new LinkedHashMap(); conditionList = new LinkedList(); relationList = new LinkedList(); orderByMap = new LinkedHashMap(); } /** * 添加查询条件 * * @param relation * 关联 "and","or"等 * @param property * 查询的对象属性 * @param condition * 查询的条件,关系符 * @param value * 查询的值 */ public SqlUtils setWhereStr(String relation, String property, String condition, Object value) { if(value != null){ relationList.add(relation); propertyMap.put(property, value); conditionList.add(condition); } return this; } private String buildWhereStr() { StringBuffer buffer = new StringBuffer(); if (!propertyMap.isEmpty() && propertyMap.size() > 0) { buffer.append("WHERE 1 = 1 "); int index = 0; for (String property : propertyMap.keySet()) { if (property != null && !property.equals("")) { buffer.append(r
防止SQL注入是开发Web应用程序时的一个重要安全措施。下面是一个简单的示例工具类,用于防止SQL注入攻击: ```java import java.sql.PreparedStatement; import java.sql.SQLException; public class SQLInjectionProtection { public static PreparedStatement prepareStatement(String query, Object... params) throws SQLException { // 创建PreparedStatement对象 PreparedStatement statement = connection.prepareStatement(query); // 为参数设置值 for (int i = 0; i < params.length; i++) { if (params[i] instanceof String) { // 对String类型的参数进行过滤 statement.setString(i + 1, sanitizeString((String) params[i])); } else { // 其他类型的参数直接设置值 statement.setObject(i + 1, params[i]); } } return statement; } private static String sanitizeString(String input) { // 对输入字符串进行过滤,替换特殊字符 String sanitized = input.replaceAll("['\"\\\\]", ""); return sanitized; } } ``` 这个工具类的核心方法是prepareStatement(),它接受一个SQL查询和参数,并返回一个已经处理好的PreparedStatement对象。在设置参数值时,对于String类型的参数,会调用sanitizeString()方法对其进行过滤,去除可能导致注入的特殊字符。 虽然这个工具类提供了一定的防护,但并不能保证完全防止SQL注入攻击。因此,还需要在开发过程中注意其他具体的防护措施,例如使用参数化查询、严格控制用户输入等。此外,及时更新数据库驱动程序和数据库软件也是保持安全的好方法。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值