在工作中，有很多项目已上线后，很多项目的数据库服务器都不会对外开放的，外网想直接访问客户数据库服务器时，可能会出现困难。
这时就需要一个可以查询，更新数据库操作的页面了；
本来用sql语句直接操作数据库数据是不好的，所以此页面工具只针对已经非常熟悉数据库结构的人来使用，因为可以执行更新/修改语句，请慎用。
目前没对这个页面做任何的访问限制，出于对数据的安全性考虑，强烈建议对本页面的访问做访问限制处理！
<%@ Page Language="C#" %>
<%@ Import Namespace="System" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.SqlClient" %>
<%@ Import Namespace="System.Collections.Generic" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">
/// <summary>
/// 【数据库连接字符串】
/// 注意：在这里需与webconfig里的数据库连接字符串配置节一致；
/// </summary>
//protected string Connection = ConfigurationManager.ConnectionStrings["sqlserver"].ConnectionString;
protected string Connection = "Data Source=.;Initial Catalog=TableTest;Persist Security Info=True;User ID=sa;Password=123456;";
/// <summary>
/// 所有数据表，前台js使用
/// </summary>
protected string DataTables { get; set; }
/// <summary>
/// 所有字段，前台js使用
/// </summary>
protected string Fields { get; set; }
/// <summary>
/// 判断连接是否成功！
/// </summary>
/// <param name="con"> 链接字符串</param>
/// <returns>true 表示链接成功，false表示连接失败</returns>
public static string CheckConnection(string con)
{
string status = "";
var conn = new SqlConnection(con);
try
{
conn.Open();
status = "true|";
}
catch (Exception ex)
{
status = "false|" + ex.Message;
}
finally
{
conn.Close();
}
return status;
}
protected void Page_Load(object sender, EventArgs e)
{
if (CheckConnection(Connection).ToLower().StartsWith("false"))
{
Response.Clear();
Response.Write("<span style='color:red'>对不起，数据库链接失败.<br/><br/>请检查数据库链接:\"" + Connection + "\" 是否正确！</span>");
Response.End();
}
else
{
//所有表
if (Cache.Get("tables") == null)
{
List<string> tables = GetTableNames(Connection);
DataTables = "[";
foreach (string table in tables)
{
DataTables += "'" + table + "',";
}
DataTables = DataTables.TrimEnd(',');
DataTables += "]";
Cache.Insert("tables", DataTables);
}
else
{
DataTables = Cache.Get("tables").ToString();
}
//所有字段
if (Cache.Get("fields") == null)
{
DataTable fields = GetFileds(Connection);
Fields = "[";
foreach (DataRow row in fields.Rows)
{
Fields += "{tName:'" + row["表名"] + "',fName:'" + row["字段名"] + "'},";
}
Fields = Fields.TrimEnd(',');
Fields += "]";
Cache.Insert("fields", Fields);
}
else
{
Fields = Cache.Get("fields").ToString();
}
if (!IsPostBack)
{
}
}
}
#region 查询
/// <summary>
/// 需过滤掉的关键字
/// </summary>
public static string[] ForbidSqlKeyword = { "ALTER", "UPDATE", "DELETE", "DROP", "CREATE", "COMMIT" };
public static bool IsContainDangerWords(string sql)
{
bool haveForbidWord = false;
sql = sql.ToLower().Replace("\r", " ").Replace("\n", " ");
string[] sqlWordArr = sql.Split(new[] { " " }, StringSplitOptions.RemoveEmptyEntries);
foreach (string word in sqlWordArr)
{
foreach (string forbidWord in ForbidSqlKeyword)
{
if (String.Compare(forbidWord.Trim(), word.Trim(), StringComparison.OrdinalIgnoreCase) == 0)
{
haveForbidWord = true;
break;
}
}
}
return haveForbidWord;
}
/// <summary>
/// 查询
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void BtnQueryClick(object sender, EventArgs e)
{
string sql = txtSql.Text.Trim();
if (!IsContainDangerWords(sql))
{
DataTable data = ExcuteDataTable(sql, Connection);
string html = GetHtmlTable(data);
ltrResult.Text = html;
}
else
{
var dt = new DataTable();
dt.Columns.Add("执行结果");
DataRow row = dt.NewRow();
row["执行结果"] = "<span class='fail'>查询语句中含有修改数据相关的关键字，操作已忽略</span>";
dt.Rows.Add(row);
string html = GetHtmlTable(dt);
ltrResult.Text = html;
}
}
#endregion
#region 执行
/// <summary>
/// 执行
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void BtnExcuteClick(object sender, EventArgs e)
{
var dt = new DataTable();
string sql = txtSql.Text.Trim();
try
{
if (Execute(sql, Connection))
{
dt.Columns.Add("执行结果");
DataRow row = dt.NewRow();
row["执行结果"] = "<span class='sucess'>执行成功</span>";
dt.Rows.Add(row);
}
else
{
dt.Columns.Add("执行结果");
DataRow row = dt.NewRow();
row["执行结果"] = "<span class='fail'>执行失败</span>";
dt.Rows.Add(row);
}
}
catch (Exception ex)
{
dt.Columns.Add("异常信息");
DataRow row = dt.NewRow();
row["异常信息"] = ex.Message;
dt.Rows.Add(row);
}
string html = GetHtmlTable(dt);
ltrResult.Text = html;
}
#endregion
#region 执行SQL语句返回DataTable
/// <summary>
/// 执行SQL语句返回DataTable
/// </summary>
/// <param name="sql"></param>
/// <param name="con"></param>
/// <returns></returns>
public static DataTable ExcuteDataTable(string sql, string con)
{
var cmd = new SqlCommand();
var connection = new SqlConnection(con);
try
{
using (connection)
{
cmd.Connection = connection;
cmd.CommandText = sql;
connection.Open();
var da = new SqlDataAdapter(cmd);
var ds = new DataSet();
da.Fill(ds);
return ds.Tables[0];
}
}
catch (Exception ex)
{
var dt = new DataTable();
dt.Columns.Add("异常信息");
DataRow row = dt.NewRow();
row["异常信息"] = ex.Message;
dt.Rows.Add(row);
return dt;
}
}
#endregion
#region DataSet转换为Html表格
/// <summary>
/// 将DataSet转换为Html表格
/// </summary>
/// <param name="dt"></param>
/// <returns></returns>
public static string GetHtmlTable(DataTable dt)
{
var html = new StringBuilder();
if (dt.Rows.Count == 0)
{
html.Append(
@"<table class='data' cellspacing='1' cellpadding='0' border='1' style='width: 100%;'>
<tbody>
<tr class='tdbg' align='center' style='height: 100px;'>
<td colspan='12'>
没有任何记录！
</td>
</tr>
</tbody>
</table>");
}
else
{
#region 表头行
html.Append(@"<table class='data' cellspacing='1' cellpadding='0' border='1' style='width: 100%;'>");
html.Append(@"<tr class='gridtitle'>");
foreach (DataColumn columns in dt.Columns)
{
string title = columns.ColumnName;
html.Append(string.Format(@"<th scope='col' class='data_th'>{0}</th>", title));
}
html.Append(@"</tr>");
#endregion
#region 表数据行
foreach (DataRow row in dt.Rows)
{
html.Append(string.Format("<tr class='data_tr'>"));
foreach (DataColumn columns in dt.Columns)
{
string cellValue = row[columns.ColumnName].ToString();
html.Append(string.Format("<td class='data_td'>{0}</td>", cellValue));
}
html.Append(@"</tr>");
}
#endregion
#region 表尾
html.Append(string.Format("<tr class='data_tr'>"));
html.Append(string.Format("<td class='data_td' colspan='{0}'>合计：{1}条记录</td>", dt.Columns.Count,
dt.Rows.Count));
html.Append(@"</tr>");
html.Append(@"</table>");
#endregion
}
return html.ToString();
}
#endregion
#region 执行不带参数sql语句
/// <summary>
/// 执行不带参数sql语句
/// </summary>
/// <param name="sql">增，删，改sql语句</param>
/// <param name="con"></param>
/// <returns>返回所影响的行数</returns>
public static bool Execute(string sql, string con)
{
var cmd = new SqlCommand();
var connection = new SqlConnection(con);
try
{
using (connection)
{
cmd.Connection = connection;
cmd.CommandText = sql;
connection.Open();
cmd.ExecuteNonQuery();
return true;
}
}
catch (Exception)
{
return false;
}
}
#endregion
/// <summary>
/// 获取指定数据库中所有表的名字；
/// </summary>
/// <param name="con">连接字符串</param>
/// <returns>所有表名的集合</returns>
public static List<string> GetTableNames(string con)
{
var tableNames = new List<string>();
try
{
var regex = new Regex(
"(?i)(Initial Catalog|database)=(?<database>[^;]*);",
RegexOptions.CultureInvariant
| RegexOptions.Compiled
);
Group database = regex.Match(con).Groups["database"];
string sql =
"SELECT SYSOBJECTS.NAME FROM SYSOBJECTS,MASTER..SYSDATABASES T WHERE TYPE='U'AND T.NAME='" +
database + "' ORDER BY SYSOBJECTS.NAME ASC";
var cmd = new SqlCommand();
var sqlcon = new SqlConnection(con);
using (sqlcon)
{
cmd.Connection = sqlcon;
cmd.CommandText = sql;
sqlcon.Open();
SqlDataReader sdr = cmd.ExecuteReader();
while (sdr.Read())
{
tableNames.Add(sdr[0].ToString());
}
}
}
catch (Exception ex)
{
tableNames.Add("异常：" + ex.Message);
}
return tableNames;
}
/// <summary>
/// 取得所有字段
/// </summary>
/// <param name="connection"></param>
/// <returns></returns>
public DataTable GetFileds(string connection)
{
const string sql = @"
SELECT 表名 = O.name,
字段名 = C.name,
类型=T.name,
字段长度= T.max_length
FROM sys.columns C
INNER JOIN sys.objects O
ON C.[object_id] = O.[object_id]
AND O.type = 'U'
AND O.is_ms_shipped = 0
INNER JOIN sys.types T
ON C.user_type_id = T.user_type_id
LEFT JOIN sys.default_constraints D
ON C.[object_id] = D.parent_object_id
AND C.column_id = D.parent_column_id
AND C.default_object_id = D.[object_id]
LEFT JOIN sys.extended_properties PFD
ON PFD.class = 1
AND C.[object_id] = PFD.major_id
AND C.column_id = PFD.minor_id
LEFT JOIN sys.extended_properties PTB
ON PTB.class = 1
AND PTB.minor_id = 0
AND C.[object_id] = PTB.major_id
LEFT JOIN -- 索引及主键信息
(
SELECT IDXC.[object_id],
IDXC.column_id,
Sort = CASE INDEXKEY_PROPERTY(
IDXC.[object_id],
IDXC.index_id,
IDXC.index_column_id,
'IsDescending'
)
WHEN 1 THEN 'DESC'
WHEN 0 THEN 'ASC'
ELSE ''
END,
PrimaryKey = CASE
WHEN IDX.is_primary_key = 1 THEN N'√'
ELSE N''
END,
IndexName = IDX.Name
FROM sys.indexes IDX
INNER JOIN sys.index_columns IDXC
ON IDX.[object_id] = IDXC.[object_id]
AND IDX.index_id = IDXC.index_id
LEFT JOIN sys.key_constraints KC
ON IDX.[object_id] = KC.[parent_object_id]
AND IDX.index_id = KC.unique_index_id
INNER JOIN -- 对于一个列包含多个索引的情况,只显示第个索引信息
(
SELECT [object_id],
Column_id,
index_id = MIN(index_id)
FROM sys.index_columns
GROUP BY
[object_id],
Column_id
) IDXCUQ
ON IDXC.[object_id] = IDXCUQ.[object_id]
AND IDXC.Column_id = IDXCUQ.Column_id
AND IDXC.index_id = IDXCUQ.index_id
) IDX
ON C.[object_id] = IDX.[object_id]
AND C.column_id = IDX.column_id
ORDER BY
O.name,
C.column_id";
return ExcuteDataTable(sql, Connection);
}
</script>
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="Head1" runat="server">
<title>数据库查询工具1.0</title>
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"> </script>
<style type="text/css">
body { font-size: 12px; }
td, th { border: 1px solid gray; border-collapse: collapse; display: table-cell; line-height: 22px; vertical-align: inherit; }
table { border-bottom-width: 0px; border-collapse: collapse; border-color: gray; border-color: gray; border-left-width: 0px; border-right-width: 0px; border-spacing: 0px; border-spacing: 0px; border-spacing: 2px; border-top-width: 0px; display: table; }
fieldset { border: 1px solid gray; margin-bottom: 10px; padding: 8px; }
.demo_title { background-color: lightgray; }
.result { max-height: 400px; max-width: 100%; overflow: auto; }
.data_th { background-color: #D3D8E0; }
.data_td { padding-left: 5px; }
.fail { color: red; font-weight: bold; }
.sucess { color: green; font-weight: bold; }
.demo_main { }
.demo_content { }
.keyword { background-color: lavender; border: 1px dashed darkgray; border-radius: 4px; cursor: pointer; margin-right: 10px; padding: 5px; }
textarea { -moz-box-shadow: 1px 1px 0 #E7E7E7; -moz-box-sizing: border-box; border-color: #CCCCCC #999999 #999999 #CCCCCC; border-style: solid; border-width: 1px; font-family: arial, sans-serif; font-size: 13px; height: 160px; margin: 10px auto; outline-color: -moz-use-text-color; outline-style: none; outline-width: medium; padding: 2px; width: 100%; }
select { height: 25px; border: 1px solid lightgray; }
</style>
</head>
<body>
<form id="form1" runat="server">
<asp:ScriptManager ID="ScriptManager1" runat="server">
</asp:ScriptManager>
<div class="demo_main">
<fieldset class="demo_title">
数据库管理工具_V1.0
</fieldset>
<fieldset class="demo_content">
<legend>查询语句： </legend>
<asp:TextBox runat="server" ID="txtSql" Style="text-transform: uppercase" TextMode="MultiLine"
Width="99%" Height="100"></asp:TextBox>
<p style="margin: 0; padding: 8px 0 0 0;">
可用表名：
<select id="selectTables" style="width: 200px;">
</select>
可用字段：
<select id="selectFields" style="width: 200px;">
<option>请选择表名</option>
</select>
可用变量： <span class="keyword">SELECT</span><span class="keyword">TOP</span><span class="keyword">100</span><span
class="keyword">*</span><span class="keyword">FROM</span><span class="keyword">DELETE</span><span
class="keyword">UPDATE </span><span class="keyword">CREATE</span>
</p>
</fieldset>
<asp:UpdatePanel ID="UpdatePanel1" runat="server">
<ContentTemplate>
<fieldset class="demo_content">
<legend>操作选项</legend>
<asp:Button runat="server" ID="btnQuery" Text="查询" OnClick="BtnQueryClick" />
<asp:Button runat="server" ID="btnExcute" Text="执行" OnClientClick=" return confirm('确定SQL语句正确并立即执行吗？') "
OnClick="BtnExcuteClick" />
<asp:UpdateProgress ID="UpdateProgress1" runat="server">
<ProgressTemplate>
<asp:Label ForeColor="green" runat="server" ID="lblStatus" Text="处理中，请稍候..." />
</ProgressTemplate>
</asp:UpdateProgress>
</fieldset>
<fieldset class="demo_content">
<legend>查询结果：</legend>
<div class="result">
<asp:Literal runat="server" ID="ltrResult"></asp:Literal>
</div>
</fieldset>
</ContentTemplate>
</asp:UpdatePanel>
</div>
<script type="text/javascript">
//====================================在文本框指定位置插入值=======================================
(function ($) {
$.fn.extend({
insertAtCaret: function (myValue) {
var $t = $(this)[0];
if (document.selection) {
this.focus();
var sel = document.selection.createRange();
sel.text = myValue;
this.focus();
} else if ($t.selectionStart || $t.selectionStart == '0') {
var startPos = $t.selectionStart;
var endPos = $t.selectionEnd;
var scrollTop = $t.scrollTop;
$t.value = $t.value.substring(0, startPos) + myValue + $t.value.substring(endPos, $t.value.length);
this.focus();
$t.selectionStart = startPos + myValue.length;
$t.selectionEnd = startPos + myValue.length;
$t.scrollTop = scrollTop;
} else {
this.value += myValue;
this.focus();
}
}
});
})(jQuery);
//==================================================================================
var tables = "<%= DataTables %>";
var fields = "<%= Fields %>";
$(function () {
tables = eval(tables);
for (var i = 0; i < tables.length; i++) {
$("#selectTables").append("<option>" + tables[i] + "</option>");
}
//选择表
$("#selectTables").change(function () {
var table = $(this).val();
fields = eval(fields);
$("#selectFields").empty();
for (var i = 0; i < fields.length; i++) {
if (fields[i].tName == table) {
$("#selectFields").append("<option>" + fields[i].fName + "</option>");
}
}
$("#<%= txtSql.ClientID %>").insertAtCaret(" " + table + " ");
});
//选择字段
$("#selectFields").change(function () {
var field = $(this).val();
if (field != "请选择表名") {
$("#<%= txtSql.ClientID %>").insertAtCaret(" " + field + " ");
}
});
//选择关键字
$(".keyword").click(function () {
var keyword = $(this).text();
$("#<%= txtSql.ClientID %>").insertAtCaret(" " + keyword + " ");
});
});
</script>
</form>
</body>
</html>
一哥们写的不错，经过简单修改，转过来了
