cyf/lserp_cs_6.0
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SVN r1218

Browse Source 
SVN-Revision: r1218
This commit is contained in:
cyf
2026-06-22 02:22:19 +00:00
parent 313655d3ac
commit 72420dd59e
4 changed files with 1434 additions and 1410 deletions
Download Patch File Download Diff File Expand all files Collapse all files
插件库/Lskj.Business/Impl/AttachImpl.cs
+13 -12
View File
@@ -349,8 +349,13 @@ namespace Lskj.Business.Impl
/// <returns>DataTable.</returns>
public static DataRow GetTempletFile(string sName, string webpath = "")
{
string sqlValue = "select * from P_fm_FileTab where sName=@sName";
DataTable dt = SqlHelper.ExecuteDataTable(sqlValue, new SqlParameter[] { new SqlParameter("@sName", sName) });
//如果文件名中有 不间断空格 会导致查不出来，所以改成 ={0}的写法
//string sqlValue = "select * from P_fm_FileTab where sName=@sName";
//DataTable dt = SqlHelper.ExecuteDataTable(sqlValue, new SqlParameter[] { new SqlParameter("@sName", sName) });
string sqlValue = string.Format("select * from P_fm_FileTab where sName='{0}'", sName.Replace("'", "''"));
DataTable dt = SqlHelper.ExecuteDataTable(sqlValue);
if (dt.Rows.Count > 1)
{
//string webpath11 = Lskj.Web.Core.Util.FileUtil.UrlEncode(HttpUtility.UrlDecode(webpath), false);
@@ -372,17 +377,13 @@ namespace Lskj.Business.Impl
// 完全参数化 SQL，彻底杜绝 SQL 注入！
sqlValue = @"SELECT * FROM P_fm_FileTab
WHERE sName = @sName
AND (webpath LIKE @path1
OR webpath LIKE @path2
OR webpath LIKE @path3)";
WHERE sName = '{0}'
AND (webpath LIKE '{1}'
OR webpath LIKE '{2}'
OR webpath LIKE '{3}')";
dt = SqlHelper.ExecuteDataTable(sqlValue,
new SqlParameter("@sName", sName),
new SqlParameter("@path1", "%" + webpath),
new SqlParameter("@path2", "%" + formatPath),
new SqlParameter("@path3", "%" + decodePath)
);
dt = SqlHelper.ExecuteDataTable(
string.Format(sqlValue,sName.Replace("'", "''"),"%" + webpath.Replace("'", "''"),"%" + formatPath.Replace("'", "''"),"%" + decodePath.Replace("'", "''")));
}
return dt.Rows.Count > 0 ? dt.Rows[0] : null;