在ASP.NET自动回发之前更改下拉项文本

Question

I am taking over a project in which a client has some annoying issues. They have a dropdown that autopostbacks on change to place the selected text into a t-sql query. Any value that has an apostrophe is causing an query error due to not being escaped

I do not have access to compiled code, but was hoping to write a quick band-aid fix to on selected changed, before posting replace an apostrophe to a double apostrophe to escape it as it goes into query.

I wrote a javscript ddl.change function that works at changing the text.

This however is not working even though the apostrophe does change into two. I was wondering if someone could help understand why.

I have two thoughts of scenarios causing the issue.

1. On autopostback, it triggers before javascript change function does, therefore passing the original value before javascript has a change to modify it.

2. The server side code only understands what it originally placed into the dropdown and therefore no matter how much I manipulate the client code, it will only see what it placed?

Can anyone confirm either of these scenarios? Help would be appreciated!

EDIT: I REVERSE ENGINEERED THE CODE, YES ITS VERY UGLY (AND SQL INJECTABLE) BUT IS NOT MINE AND I CANNOT MODIFY IT

C# Code

protected void ddls_SelectedIndexChanged(object sender, EventArgs e)
    {
        if (this.ddls.SelectedIndex == 0)
        {
            this.pnlA.Visible = false;
        }
        else
        {
            this.pnlA.Visible = true;
            string text = Common.GetSql("~/Sql/" + this._Conn + "/PropertyAddressReverseSearch.sql", false, true).Split(new char[]
            {
                Conversions.ToChar(this._Delimiter)
            })[4];
            text = string.Concat(new string[]
            {
                "SELECT * FROM (",
                text,
                ") a WHERE StreetName='",
                this.ddls.SelectedItem.Text,
                "' "
            });
            this.Bind(this.ddla, text);
            this.ddla.Items.Insert(0, new ListItem("I'm not sure of the house number...", Conversions.ToString(-1)));
            this.ddla.Items.Insert(0, new ListItem("", Conversions.ToString(0)));
            this.map.Visible = false;
        }
    }

Javscript + Control

<asp:dropdown runat="server" id="ddls" autopostback="true">
<script type="javascript/text">
    $(document).ready(function() {
       $("select[id$='adsearch_ddls']").change(function() {
           var ddlsValue = $("select[id$='adsearch_ddls'] option:selected").text();
            ddlsValue = ddlsValue.replace(/'/g,"\'\'");
           $("select[id$='adsearch_ddls'] option:selected").text(ddlsValue);
           return false;
       });
    });

</script>

Answer 1

You can not modify (or add/remove) the Select/dropdown list items client-side, and simply get the same server-side items, with ASP.NET Webforms when viewstate is enabled.

Unless you send back the modified items in another way, like for example in this answer where list items are copied to a hidden field:

function SaveList()
{
//Clear the hidden field
var hField =  document.getElementById('<%= YourHiddenField.ClientID %>'); 
hField.value = '' ;

var selectedList = document.getElementById('<%= YourDropDownList.ClientID %>')
for(i = 0; i < selectedList.options.length; ++i)
{         
hField.value = hField.value + ',' + selectedList.options[i].value;
}

That is, assuming by "On selected index change calls server side code" you mean a postback is triggered?

Disabling the ViewState will cause other problems (like SelectedIndexChanged not triggering, etc).

You could handle the selection change through your own (AJAX) postback. But the difference between server- and client-side list items would still remain.