在 ASP.Net web 应用程序数据层中实现 Static 方法是否安全？

Question

I am working on an web application, which is a B2B portal App. I am following 2 tier architecture for my app. Below is a piece of code that registers a company to my website

/// <summary>
        /// Register Company with the business bazaar
        /// </summary>
        /// <param name="registration"></param>
        /// <returns></returns>
        public static bool RegisterCompany(Registration registration)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_RegisterCompany";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter("@Name",registration.RegisteredUser.Name),
                                        new SqlParameter("@Designation",registration.Designation ),
                                        new SqlParameter("@Email",registration.RegisteredUser.Email ),
                                        new SqlParameter("@AltEmail",registration.RegisteredUser.AlternateEmail ),
                                        new SqlParameter("@City",registration.City ),
                                        new SqlParameter("@State",registration.State ),
                                        new SqlParameter("@Country",registration.Country ), 
                                        new SqlParameter("@Telephone",registration.Telephone ),
                                        new SqlParameter("@Mobile",registration.Mobile ),
                                        new SqlParameter("@CompanyName",registration.CompanyName ),
                                        new SqlParameter("@Website",registration.Website ),
                                        new SqlParameter("@LoginId",registration.RegisteredUser.UserName ),
                                        new SqlParameter("@Password",registration.RegisteredUser.Password ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool) success.Value;
            }
            return result;

        }

What I want to say is that i am using Static methods for all my datalayer methods. As I have gone through various articles on the web stating that Static methods has more advantages over Non-Static methods. So I have designed my code that way. But few days ago I came across ab article that says static methods are useful when you design some utilities for your class other wise use Non-Static, as same static objects are avalaible to other users.So I just want to make clear which approach to follow, static or non static.

I am using class in this format:

public sealed class MyClass
{
    private MyClass(){}
    public static DataTable GetUserInfoByUserId(int userId)
    {
       // My datalayer code goes here
    }
}

SO i am cofused if making the above method static, would'nt make the data of user 1 available to user 2 accessing the application simultaneously. Basically, I want to know the flaws of this design.

UPDATED Below is my class, showing my approach

#region

using System.Data;
using System.Data.SqlClient;
using System;

#endregion

namespace InnovativeTechnosoft.BusinessBazaar.Core
{
    public sealed class UserData
    {
        private static string _commandText = string.Empty;


        /// <summary>
        /// Takes username and password as input and sets 
        /// the current user in sessionif the user authenticate
        /// successfully
        /// </summary>
        /// <param name="userName">username as string</param>
        /// <param name="password">password as string</param>
        /// <returns>datatable</returns>
        public static DataTable IsAuthenticated(string userName, string password)
        {
            DataTable dtResult;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_AuthenticateUsers";
                var parameters = new[]
                                     {
                                         new SqlParameter("@username", userName),
                                         new SqlParameter("@password", password),
                                     };
                dtResult = helper.ExecuteSelect(_commandText, CommandType.StoredProcedure, parameters);
            }

            return dtResult;
        }

        /// <summary>
        /// Checks for username if it exists or not
        /// </summary>
        /// <param name="userName"></param>
        /// <returns></returns>
        public static bool IsExistingUser(string userName)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_IsExistingUserName";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                              "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter("@userName", userName),
                                         success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool)success.Value;
            }

            return result;
        }

        /// <summary>
        /// Register Company with the business bazaar
        /// </summary>
        /// <param name="registration"></param>
        /// <returns></returns>
        public static bool RegisterCompany(Registration registration)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_RegisterCompany";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter("@Name",registration.RegisteredUser.Name),
                                        new SqlParameter("@Designation",registration.Designation ),
                                        new SqlParameter("@Email",registration.RegisteredUser.Email ),
                                        new SqlParameter("@AltEmail",registration.RegisteredUser.AlternateEmail ),
                                        new SqlParameter("@City",registration.City ),
                                        new SqlParameter("@State",registration.State ),
                                        new SqlParameter("@Country",registration.Country ), 
                                        new SqlParameter("@Telephone",registration.Telephone ),
                                        new SqlParameter("@Mobile",registration.Mobile ),
                                        new SqlParameter("@CompanyName",registration.CompanyName ),
                                        new SqlParameter("@Website",registration.Website ),
                                        new SqlParameter("@LoginId",registration.RegisteredUser.UserName ),
                                        new SqlParameter("@Password",registration.RegisteredUser.Password ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool) success.Value;
            }
            return result;

        }

        /// <summary>
        /// Recovers Password 
        /// </summary>
        /// <param name="email"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static bool RecoverPassword(string email, out string password)
        {
            bool result;
            password = string.Empty;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_RecoverPassword";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var pwd = new SqlParameter("@Password", SqlDbType.NVarChar, 50, ParameterDirection.Output, true, 0, 0, "Password", DataRowVersion.Default, string.Empty);
                var parameters = new[]
                                     {
                                        new SqlParameter("@Email",email ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool)success.Value;
                password = Convert.ToString(pwd.Value);
            }
            return result;
        }
        /// <summary>
        /// Update  Password 
        /// </summary>
        /// <param name="email"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static bool UpdatePassword(int userId,string password)
        {
            bool result;
            using (var helper = new DbHelper())
            {
                _commandText = "sp_UpdatePassword";
                var success = new SqlParameter("@Success", SqlDbType.Bit, 1, ParameterDirection.Output, true, 0, 0,
                                               "Result", DataRowVersion.Default, 0);
                var parameters = new[]
                                     {
                                         new SqlParameter ("@UserId",userId),
                                        new SqlParameter("@Password",password ),
                                        success,
                                     };
                helper.ExecuteScalar(_commandText, CommandType.StoredProcedure, parameters);
                result = (bool)success.Value;
            }
            return result;
        }

    }
}

It would be a great help.

Regards Amit Ranjan

Answer 1

You can uses static functions, but you should avoid static variables or members at all. In short, don't "save" any information in static context. These are available in application scope and that may be the same for different requests from different users.

Running data access operations in static functions should be no problem.

Answer 2

Making your methods instance instead of static might help you with maintenance down the road. For example, perhaps you'll want to be able to substitute a different implementation of your DBHelper class in some cases.

Right now, since your static method calls var helper = new DbHelper() , you are locked into using that instance. However, let's say you want to write some unit tests that use a different DbHelper class that connects to a different database. You'd be better off with a class like:

    public class DataLayer {
        public DataLayer(IDbHelper dbHelper){
            this.DbHelper = dbHelper;
        }
        public IDbHelper DbHelper { get; private set; }

        public void RunQuery(){
            // Do stuff with dbhelper
        }
    }

Now you can pass in a different DbHelper in different circumstances.