特殊字符所需的验证
我们的 ASP.NET 应用程序中有用户创建功能。这将在数据库中为新用户创建一个条目，并在 Active Directory 中创建一个新帐户。可以使用应用程序中的其他功能来搜索所有现有用户。
目前只允许输入英文字母和数字进行用户创建。然而，客户也想输入特殊字符。当我们尝试时，我们发现了以下两个问题。
1) 当仅使用特殊字符创建用户时，会引发错误
2) 当通过输入 % 搜索时（仅查看名称中包含 @ 的用户），将返回所有用户。
您能否列出其他可能的问题，以便我们可以形成所需的验证（例如不应允许使用％）。
注意：“英文字母和数字”以外的任何字符都被视为特殊字符。
DECLARE @CharacterVal VARCHAR(10)
SET @CharacterVal = '%'
SELECT * FROM USerDetails WHERE First_Name LIKE @CharacterVal
谢谢利乔
We have a user creation functionality in our ASP.NET application. This will create an entry in the database for the new user as well as create a new account in Active Directory. All the existing users can be searched using another functionality in the application.
At present only English alphabets and numbers are allowed to enter for user creation. However, the client wants to enter special characters also. When we tried we found following tow issues.
1) When a user is created with only special characters, it is throwing error
2) When searched by entering % (to see only users having @ in name), all the users are returned.
Can you please list out other possible issues so that we can form the required validations (like % should not be allowed).
Note: Anything other than “English alphabets and numbers” are considered as special character.
DECLARE @CharacterVal VARCHAR(10)
SET @CharacterVal = '%'
SELECT * FROM USerDetails WHERE First_Name LIKE @CharacterVal
Thanks
Lijo
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
就 Active-Directory 而言，这篇 Microsoft 文章 描述了以下字符：登录名中不允许使用以下内容：
" / \ [ ] : ; | = , + * ? < >
As far Active-Directory is concerned this Microsoft article discribed that caracters that are not allowed in logon name are:
" / \ [ ] : ; | = , + * ? < >
如果您认真考虑安全性，请不要通过黑名单来执行此操作。获取客户想要的字符列表，然后仅将这些字符列入白名单。
Don't do this via a blacklist if you're serious about security. Get a list of characters that the client wants, then whitelist only those.
(1) 特殊字符是一个更广泛的问题 - 您可能需要转换输入：
http://support.microsoft.com/kb/232580
(2) 可以使用所有字符在sql server中使用转义子句：
从表 WHERE 中选择列
列 LIKE '%\@%' ESCAPE '\'
(1) Special characters are a wider issue - you may need to convert the input:
http://support.microsoft.com/kb/232580
(2) All characters may be allowed using the escape clause in sql server:
SELECT columns FROM table WHERE
column LIKE '%\@%' ESCAPE '\'