blocks|key|1707085|text|这种方法的问题是，它们仍然可能传递一个不映射到页面的整数。如果他们这样做了，只需返回404，就像你对"foo“所做的那样。除非你有明确的安全隐患，否则这是不值得担心的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1707086|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The problem with that approach is that they still might pass an integer which doesn't map to a page. Just return a 404 if they do that, just as you would with "foo". It's not something to worry about unless you have clear security implications.

blocks|key|1492129|text|在ASP.NET+MVC中，您可以定义一个实现IActionFilter接口的过滤器。您将能够使用此属性装饰您的操作，以便它将在您的操作上、操作之前或操作之后执行。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1492130|在您的例子中，您将把它定义为在您的操作之前执行。这样，如果传递的参数中有错误，您可以取消它。这里的主要好处是，你只需编写一次检查传递的参数的代码(即，你在过滤器中定义它)，并在你的控制器操作中使用它。|1492131|有关MVC+filter的更多信息，请单击此处：http://haacked.com/archive/2008/08/14/aspnetmvc-filters.aspx|offset|length|1492132|entityMap|0|LINK|mutability|MUTABLE|url|http://haacked.com/archive/2008/08/14/aspnetmvc-filters.aspx^0|0|0|O|1O|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@$F|S|G|T|1|U]]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

In ASP.NET MVC, you can define a filter implementing IActionFilter interface. You will be able to decorate your action with this attribute so that it will be executed on, before or after your action.

In your case, you will define it to be executed "before" your action. So that, you will be able to cancel it if there is an error in the passed parameters. The key benefit here that you only write the code which checking the passed paramaters once (i.e you define it in your filter) and use it wherever you want in your controller actions.

Read more about MVC filters here: <a href="http://haacked.com/archive/2008/08/14/aspnetmvc-filters.aspx" rel="nofollow noreferrer">http://haacked.com/archive/2008/08/14/aspnetmvc-filters.aspx</a>

blocks|key|1492197|text|可以将约束指定为正则表达式，也可以定义自定义约束。看看这篇博客文章，了解更多信息：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1492198|http://weblogs.asp.net/stephenwalther/archive/2008/08/06/asp-net-mvc-tip-30-create-custom-route-constraints.aspx|offset|length|1492199|你仍然需要处理id+43243没有映射到任何可以作为IActionFilter或者直接在你的控制器中处理的东西的情况。|1492200|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|34|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@$D|Q|E|R|1|S]]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|C]]]]

You can specify constraints as regular expressions or define custom constraints. Have a look at this blog post for more information:

<a href="http://weblogs.asp.net/stephenwalther/archive/2008/08/06/asp-net-mvc-tip-30-create-custom-route-constraints.aspx" rel="nofollow noreferrer">http://weblogs.asp.net/stephenwalther/archive/2008/08/06/asp-net-mvc-tip-30-create-custom-route-constraints.aspx</a>

You will still need to deal with the situation where id 43243 doesn't map to anything which could be dealt with as an IActionFilter or in your controller directly.

blocks|key|1492281|text|这里有一些有用的信息，可能会有所帮助。如果你有一个动作方法|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1492282|public+ActionResult+Edit(int?+id)
{}|code-block|syntax|javascript|1492283|然后如果有人输入|1492284|/Home/Edit/23|1492285|参数id将为23。但是，如果有人键入|1492286|/Home/Edit/Junk|1492287|那么id将为null，这很酷。我以为它会抛出一个强制转换错误之类的东西。这意味着如果id不是空值，那么它就是一个有效的整数，并且可以传递给你的服务，等等，以便进行数据库交互。|1492288|希望这能为你提供一些我在测试时发现的信息。|1492289|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|X|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|Y|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|Z|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|10|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|11|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|T|$]]

Here is some useful infromation that might help.
If you have a action method 

<pre><code>public ActionResult Edit(int? id)
{}
</code></pre>

then if someone types in 

<pre><code>/Home/Edit/23
</code></pre>

the parameter id will be 23.
however if someone types in 

<pre><code>/Home/Edit/Junk
</code></pre>

then id will be null which is pretty cool. I thought it would throw a cast error or something. It means that if id is not a null value then it is a valid integer and can be passed to your services etc. for db interaction.

Hope this provides you with some info that I have found whilst testing.

What's the best way to handle a visitor constructing their own URL and replacing what we expect to be an ID with anything they like?

For example:

<a href="https://stackoverflow.com/questions/236349">ASP.Net MVC - handling bad URL parameters</a>

But the user could just as easily replace the URL with:

<a href="https://stackoverflow.com/questions/foo">https://stackoverflow.com/questions/foo</a>

I've thought of making every Controller Function parameter a <code>String</code>, and using <code>Integer.TryParse()</code> on them - if that passes then I have an ID and can continue, otherwise I can redirect the user to an Unknown / not-found or index View.

Stack Overflow handles it nicely, and I'd like to too - how do you do it, or what would you suggest?

ASP.Net MVC - handling bad URL parameters

数据库

处理访问者构建自己的URL并将我们期望的ID替换为他们喜欢的任何东西的最佳方法是什么？例如：但是用户也可以很容易地将URL替换为：我已经想过让每个控制器函数参数都成为一个String，并对它们使用Integer.TryParse() -如果通过了，那么我就有了一个ID并可以继续，否则我可以将用户重定向到未知/未找到或索...

问URL处理错误的ASP.Net参数
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问URL处理错误的ASP.Net参数EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问URL处理错误的ASP.Net参数
EN