正确检查数据库中是否已存在记录

Question

I have read other questions on this, but it does not help for the most part. Trying to check if a file has already been uploaded(filename is sent to this table) before creating another record and allowing them to upload the same file again.

I am using this code and it keeps telling me every file is a new file, even when I use the same file for testing. Obviously it should result in "Exists". Connection is already established using "this.Master.Conn" so please no SQLCommand stuff.

I even tried using wildcards in the query.

   private string SQLCheck(string FileName)
{
    string Check = "Select VideoURL from TrainingVideo2 where VideoURL Like '" + FileName +"' and Status=1;";

    Object ob = this.Master.Conn.ExecuteSqlScalarCommand(Check);
    string Result;
    if (DBNull.Value.Equals(ob))
    {
        Result = "Exists";
    }
    else
    {
        Result = "NewFile";
    }
    return Result;
}

Also, does anybody have a better(more efficient) way of doing this?

Trying to basically rewrite this in c#.

    Private Function CheckName(name As String) As Int32
    Dim sql As String = "SELECT ID FROM Company Where Name Like '" & name & "' "
    Dim ob As Object = Conn.ExecuteSqlScalarCommand(sql)
    If IsDBNull(ob) Then
        Return 0
    Else
        Return CInt(ob)
    End If
End Function

Answer 1

Never build up an SQL string like that. See SQL injection .

Why are you using like ? Do you really have Sql wildcards in that fileName ?

Example (sorry for the " SqlCommand stuff", but it's important):

string sql = "select count(*) from TrainingVideo2 where VideoURL = @Name and Status=1"
using (SqlConnection conn = new SqlConnection(connString))
{
    SqlCommand cmd = new SqlCommand(sql, conn);
    cmd.Parameters.Add("@Name", fileName);
    conn.Open();
    return (Int32)cmd.ExecuteScalar() > 0;
}

Answer 2

There are new and more innovative methods devised to get around the simple "replace all ` and " characters with ..." SQL injection prevention techniques. In your case, if the VideoURL happens to be a varchar (and not nvarchar), then using unicode character U+02BC (URL encoded = %CA%BC ) would pass in a quote character as a unicode string, which would bypass your C# checks, but SQL Server will conveniently convert to a quote character in your query. This is just one example of why you should not be doing this :).

In terms of you check, I always prefer using TOP 1 to let SQL Server cut a potential table scan short. So, I would use this query:

Select TOP 1 SomeNonNullIntColumn from TrainingVideo2 where VideoURL Like ... and Status=1;

Execute the query with ExecuteScalar. If the result is null , then the record does not exist.