当前位置：文江博客话题详情

在查询字符串中使用创建的 UserId 的 ASP.NET 成员资格

发布于 2024-10-16 17:28:13 字数 119 浏览 2 评论 0原文

您好，我目前正在学习 .net，并正在使用 .net 构建我的第一个真正的网站。

我只是想知道人们是否认为可以在查询字符串中使用生成的成员资格 UserId？并使用它作为数据库中的外键将相关信息链接到该用户？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

生生不灭 2024-10-23 17:28:13

为什么在查询字符串中需要它？它是由...提供的，

If HttpContext.Current.User.Identity.IsAuthenticated Then
    Dim user As MembershipUser = Membership.GetUser()
    Dim guid as Guid= DirectCast(user.ProviderUserKey, Guid)
End If

即使这不会导致安全问题，我也不会向用户显示如此敏感的数据，但这只是因为如果每个人都能看到比他需要看到的更多内容，那么应用程序看起来就不安全。您可以将其临时存储在会话中，以便将其从第 1 页传递到第 2 页。

如果要将 UserID 保存为外键，可以使用 MembershipProvider 提供的 uniqueid。

如果您想使用整数（可读性、更少的磁盘空间），则必须创建一个表（aspnet_UserID），以一对一的关系将 guid 映射到您的 int-ID。还为 aspnet_Users 表上的插入和删除创建触发器，例如

CREATE TRIGGER [dbo].[trgCreateUserID] ON [dbo].[aspnet_Users]
FOR INSERT
AS

INSERT INTO dbo.aspnet_UserId(fiUser)
    SELECT UserID FROM inserted

：

CREATE TRIGGER [dbo].[trDeleteUserID] ON [dbo].[aspnet_Users]
FOR DELETE
AS

DELETE FROM dbo.aspnet_UserId 
    WHERE fiUser IN(SELECT UserID FROM DELETED)

Why do you need it in a querystring? It is provided by...

If HttpContext.Current.User.Identity.IsAuthenticated Then
    Dim user As MembershipUser = Membership.GetUser()
    Dim guid as Guid= DirectCast(user.ProviderUserKey, Guid)
End If

I wouldn't display such sensitive data users even if this wouldn't cause security issues, but simply because an application looks unsafe if everybody can see more than he needs to see. You could store it temporarily in the Session to pass it from page 1 to page2.

If you want to save the UserID as foreignkey its possible to use the uniqueid provided by the MembershipProvider.

If you want to use an integer instead(readability, less disk space), you have to create a table(aspnet_UserID) that maps the guid to your int-ID in a one-to-one relationship. Create also a trigger for inserts and deletes on the aspnet_Users-table, for example:

CREATE TRIGGER [dbo].[trgCreateUserID] ON [dbo].[aspnet_Users]
FOR INSERT
AS

INSERT INTO dbo.aspnet_UserId(fiUser)
    SELECT UserID FROM inserted

and

CREATE TRIGGER [dbo].[trDeleteUserID] ON [dbo].[aspnet_Users]
FOR DELETE
AS

DELETE FROM dbo.aspnet_UserId 
    WHERE fiUser IN(SELECT UserID FROM DELETED)

回复收藏 0 原文