检测空值并替换字符串C#
检测空值并替换字符串C#
提问于 2016-08-15 14:50:21
目前，我的CSV到SQL转换器有一些问题。该程序用于创建命令来编辑数据库、用户列表、更新或添加新的数据库。我的问题是，如果用户没有在CSV文件中输入密码，我希望将其设置为用户id。目前，我得到了这个IF语句，试图检测字符串是否为空，但是它总是说字符串是空的，即使在单元格中有文本时，它也会给我我的设置弹出框。
if (password != null)
{
System.Windows.Forms.MessageBox.Show("Setting Password to User ID");
}我也尝试过密码=password.replace(用户it )，但是它不会改变字符串。如果这有帮助的话，我已经在下面列出了我的全部代码。
private void LoadBtn_Click(object sender, EventArgs e)
{
//Opens a browse box to allow the user to select which file, only CSV's allow allowed
OpenFileDialog openFileDialog1 = new OpenFileDialog();
openFileDialog1.Filter = "CSV Files (*.csv)|*.csv";
openFileDialog1.FilterIndex = 1;
//empties text box when clicked | loads file location and name to load directory text box at top
if (openFileDialog1.ShowDialog() == System.Windows.Forms.DialogResult.OK)
{
ConvertedText.Text = string.Empty;
LoadDirectory.Text = openFileDialog1.FileName.ToString();
}
string filename = LoadDirectory.Text;
string[] Lines = File.ReadAllLines(filename);
string[] Fields;
for (int i = 1; i < Lines.Length; i++)
{
string outfile = "";
Fields = Lines[i].Split(new char[] { ',' });
string userid = Fields[0];
string password = Fields[1];
string fullname = Fields[2];
string address = Fields[3];
string telephone = Fields[4];
string email = Fields[5];
string role = Fields[6];
string department = Fields[7];
if (password != null)
{
System.Windows.Forms.MessageBox.Show("Setting Password to User ID");
}
outfile += "IF exists (SELECT USERID FROM WUSERS WHERE USERID='" + userid + "')" + Environment.NewLine;
outfile += "begin" + Environment.NewLine;
outfile += Environment.NewLine;
outfile += "-- Update it" + Environment.NewLine;
outfile += "print 'updated'" + Environment.NewLine;
outfile += "update WUSERS set FULLNAME= '" + fullname + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "update WUSERS set PW= '" + password + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "update WUSERS set addr= '" + address + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "update WUSERS set telno= '" + telephone + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "update WUSERS set email= '" + email + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "update WUSERS set ROLEID= '" + role + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "update WUSERS set dept= '" + department + "' where userid= '" + userid + "'" + Environment.NewLine;
outfile += "end" + Environment.NewLine;
outfile += "else" + Environment.NewLine;
outfile += "begin" + Environment.NewLine;
outfile += "-- add it" + Environment.NewLine;
outfile += "print 'added'" + Environment.NewLine;
outfile += "insert into WUSERS (USERID,PW,FULLNAME,ADDR,TELNO,EMAIL,ROLEID,DEPT) Values ('" + userid + "','" + password + "','" + fullname + "','" + address + "','" + telephone + "','" + email + "','" + role + "','" + department + "')";
outfile += Environment.NewLine;
outfile += "end";
outfile += Environment.NewLine;
outfile += Environment.NewLine;
outfile += Environment.NewLine;
outfile += "-----------------------------------------------------------------------------------------------------------------------------------------------";
outfile += Environment.NewLine;
outfile += Environment.NewLine;
outfile += Environment.NewLine;
ConvertedText.AppendText(outfile);
}
}谢谢您的任何意见。
欧文
回答 2
Stack Overflow用户
回答已采纳
发布于 2016-08-15 14:52:52
也许你想
if (password == null)但我建议你用更完整的
if(string.IsNullOrWhiteSpace(password))
...error message...说我不能不提醒你注意下面的代码。我希望所有这些更新的WUSERS不是用来真正更新一个数据库。这种字符串级联的方法是众所周知的，因为它的问题，从更简单到最坏的问题，语法错误，解析错误，Sql注入攻击。
Stack Overflow用户
发布于 2016-08-15 14:55:03
考虑了现有的方法
与其直接比较null，您可能希望使用更合适的方法，比如基于您的首选项/需求的String.IsNullOrEmpty()或String.IsNullorWhiteSpace()方法：
if (!String.IsNullOrEmpty(password))
{
System.Windows.Forms.MessageBox.Show("Setting Password to User ID");
}使用参数化代替字符串级联。
当前，现有代码使您容易受到SQL注入攻击，因为您只是将值连接起来以构建查询，如下所示：
"... SELECT WHERE USERID='" + userid + "')" + Environment.NewLine;您应该考虑做的是在查询中使用参数，然后在执行之前设置这些参数的值：
"... SELECT WHERE USERID= @userid)" + Environment.NewLine;这不仅可以更好地保护您免受SQL注入的影响，而且还可以使您的查询更容易阅读，并减少出现与排版相关的语法错误的可能性(例如，值周围缺少引号等)。
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/38957443
复制相关文章
相似问题
腾讯云开发者
