You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

如何防止ASP.NET页面刷新时重复向SQL数据库保存数据？

avatar
安全阿岳
2026-7-18
问题

点击Button1将数据保存至SQL数据库后，执行ClearAllData清空所有字段，但刷新页面时，即使字段为空且未点击Button1，仍会向SQL数据库插入新数据。已在Page_Load中使用!IsPostBack，但问题依旧。

原始代码 

protected void Page_Load(object sender, EventArgs e)
{
    if (!IsPostBack)
    {
    }
}
public void ClearAllData()
{
    DropDownList1.SelectedValue = DropDownList1.Items[0].ToString();
    DropDownList2.SelectedValue = DropDownList2.Items[0].ToString();
    DropDownList3.SelectedValue = DropDownList3.Items[0].ToString();
    DropDownList4.SelectedValue = DropDownList4.Items[0].ToString();
    DropDownList5.SelectedValue = DropDownList5.Items[0].ToString();
    TextBox1.Text = "";
    Label1.Text = "";

}


protected void Button1_Click(object sender, EventArgs e)
{
    if (!string.IsNullOrEmpty(DropDownList5.SelectedValue))
    {
        SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True");
        con.Open();
        SqlCommand comm = new SqlCommand("Update Dispatcher_Roles set Name = '" + DropDownList1.SelectedValue + "',Position = '" + DropDownList2.SelectedValue + "',Roles = '" + TextBox1.Text + "',Status = '" + DropDownList3.SelectedValue + "',DispatcherCovering = '" + DropDownList4.SelectedValue + "' where Name='" + DropDownList1.SelectedValue + "'", con);
        comm.ExecuteNonQuery();
        con.Close();
        Label1.Text = "Update Saved";
        ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Updated');", true);
        ClearAllData();
    }
    if (!string.IsNullOrEmpty(DropDownList1.SelectedValue))
    {
        SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True");
        con.Open();
        SqlCommand comm = new SqlCommand("Insert into Dispatcher_Roles values ('" + DropDownList1.SelectedValue + "','" + DropDownList2.SelectedValue + "','" + TextBox1.Text + "','" + DropDownList3.SelectedValue + "','" + DropDownList4.SelectedValue + "')", con);
        comm.ExecuteNonQuery();
        con.Close();
        ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Added');", true);
        Label1.Text = "Entry Saved";
        ClearAllData();
    }
    if (DropDownList1.SelectedValue == "" || DropDownList2.SelectedValue == "" || TextBox1.Text == "")
    {
        Label1.Text = "Fill In All Fields";
    }

}

protected void Button2_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True");
    con.Open();
    SqlCommand comm = new SqlCommand("Update Dispatcher_Roles set Name = '" + DropDownList1.SelectedValue + "',Position = '" + DropDownList2.SelectedValue + "',Roles = '" + TextBox1.Text + "',Status = '" + DropDownList3.SelectedValue + "',DispatcherCovering = '" + DropDownList4.SelectedValue + "' where Name='" + DropDownList1.SelectedValue + "'", con);
    comm.ExecuteNonQuery();
    con.Close();
    ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Updated');", true);
    ClearAllData();
}

protected void Button3_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True");
    con.Open();
    SqlCommand comm = new SqlCommand("Delete Dispatcher_Roles Where Name='" + DropDownList1.SelectedValue + "'", con);
    comm.ExecuteNonQuery();
    con.Close();
    ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Deleted');", true);
    ClearAllData();
}

protected void Button5_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True");
    con.Open();
    SqlCommand comm = new SqlCommand("select * from Dispatcher_Roles where Name= '" + DropDownList5.SelectedValue + "'", con);
    SqlDataReader r = comm.ExecuteReader();
    while (r.Read())
    {
        DropDownList1.SelectedValue = r.GetValue(1).ToString();
        DropDownList2.SelectedValue = r.GetValue(2).ToString();
        TextBox1.Text = r.GetValue(3).ToString();
        DropDownList3.SelectedValue = r.GetValue(4).ToString();
        DropDownList4.SelectedValue = r.GetValue(5).ToString();
    }
}

protected void Button6_Click(object sender, EventArgs e)
{
    ClearAllData();
}

protected void TextBox1_TextChanged(object sender, EventArgs e)
{

}
}

问题根源

  1. 页面刷新重复提交：ASP.NET中点击Button1会触发PostBack，刷新页面时浏览器会重新发送上次的Post请求，导致Button1_Click事件被重复执行。
  2. 清空逻辑与判断不匹配：ClearAllData将DropDownList1设为第一个项的文本（并非空值），而插入判断仅检查DropDownList1.SelectedValue是否非空，刷新时该条件成立，触发插入。
  3. SQL注入风险：直接拼接SQL字符串，存在严重安全漏洞，同时数据库连接代码重复，资源释放不严谨。
  4. 逻辑分支冲突：Button1_Click中使用多个独立if，可能同时触发多个分支（比如更新和插入逻辑同时执行）。

解决方案

1. 实现Post/Redirect/Get模式，避免重复提交

执行完数据操作后，重定向到当前页面，彻底解决刷新重复提交问题：

// 替换原有的ScriptManager注册代码，增加页面重定向
ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Updated');window.location.href = window.location.href;", true);

或使用服务器端重定向：

Response.Redirect(Request.Url.AbsoluteUri);

2. 修正清空逻辑与判断条件

  • 修改ClearAllData，确保下拉列表选中值为空字符串（需提前将下拉列表第一个项的Value设为空）：
public void ClearAllData()
{
    DropDownList1.SelectedValue = "";
    DropDownList2.SelectedValue = "";
    DropDownList3.SelectedValue = "";
    DropDownList4.SelectedValue = "";
    DropDownList5.SelectedValue = "";
    TextBox1.Text = "";
    Label1.Text = "";
}
  • 调整Button1_Click的判断逻辑，使用else if避免多分支同时触发，且严格检查必填项：
protected void Button1_Click(object sender, EventArgs e)
{
    if (!string.IsNullOrEmpty(DropDownList5.SelectedValue))
    {
        // 更新逻辑
    }
    else if (!string.IsNullOrEmpty(DropDownList1.SelectedValue) 
             && !string.IsNullOrEmpty(DropDownList2.SelectedValue) 
             && !string.IsNullOrWhiteSpace(TextBox1.Text))
    {
        // 插入逻辑
    }
    else
    {
        Label1.Text = "Fill In All Fields";
    }
}

3. 修复SQL注入，优化数据库操作

使用参数化SQL，并封装数据库连接逻辑，确保资源自动释放：

// 封装数据库操作方法
private void ExecuteSqlCommand(string sql, params SqlParameter[] parameters)
{
    using (SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True"))
    {
        con.Open();
        using (SqlCommand comm = new SqlCommand(sql, con))
        {
            comm.Parameters.AddRange(parameters);
            comm.ExecuteNonQuery();
        }
    }
}

修改插入逻辑为参数化：

string insertSql = "INSERT INTO Dispatcher_Roles (Name, Position, Roles, Status, DispatcherCovering) VALUES (@Name, @Position, @Roles, @Status, @DispatcherCovering)";
ExecuteSqlCommand(insertSql,
    new SqlParameter("@Name", DropDownList1.SelectedValue),
    new SqlParameter("@Position", DropDownList2.SelectedValue),
    new SqlParameter("@Roles", TextBox1.Text),
    new SqlParameter("@Status", DropDownList3.SelectedValue),
    new SqlParameter("@DispatcherCovering", DropDownList4.SelectedValue));

修改后的完整代码 

protected void Page_Load(object sender, EventArgs e)
{
    if (!IsPostBack)
    {
    }
}

public void ClearAllData()
{
    DropDownList1.SelectedValue = "";
    DropDownList2.SelectedValue = "";
    DropDownList3.SelectedValue = "";
    DropDownList4.SelectedValue = "";
    DropDownList5.SelectedValue = "";
    TextBox1.Text = "";
    Label1.Text = "";
}

// 封装数据库操作方法
private void ExecuteSqlCommand(string sql, params SqlParameter[] parameters)
{
    using (SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True"))
    {
        con.Open();
        using (SqlCommand comm = new SqlCommand(sql, con))
        {
            comm.Parameters.AddRange(parameters);
            comm.ExecuteNonQuery();
        }
    }
}

protected void Button1_Click(object sender, EventArgs e)
{
    if (!string.IsNullOrEmpty(DropDownList5.SelectedValue))
    {
        string updateSql = "UPDATE Dispatcher_Roles SET Position = @Position, Roles = @Roles, Status = @Status, DispatcherCovering = @DispatcherCovering WHERE Name = @Name";
        ExecuteSqlCommand(updateSql,
            new SqlParameter("@Name", DropDownList1.SelectedValue),
            new SqlParameter("@Position", DropDownList2.SelectedValue),
            new SqlParameter("@Roles", TextBox1.Text),
            new SqlParameter("@Status", DropDownList3.SelectedValue),
            new SqlParameter("@DispatcherCovering", DropDownList4.SelectedValue));
            
        Label1.Text = "Update Saved";
        ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Updated');window.location.href = window.location.href;", true);
        ClearAllData();
    }
    else if (!string.IsNullOrEmpty(DropDownList1.SelectedValue) 
             && !string.IsNullOrEmpty(DropDownList2.SelectedValue) 
             && !string.IsNullOrWhiteSpace(TextBox1.Text))
    {
        string insertSql = "INSERT INTO Dispatcher_Roles (Name, Position, Roles, Status, DispatcherCovering) VALUES (@Name, @Position, @Roles, @Status, @DispatcherCovering)";
        ExecuteSqlCommand(insertSql,
            new SqlParameter("@Name", DropDownList1.SelectedValue),
            new SqlParameter("@Position", DropDownList2.SelectedValue),
            new SqlParameter("@Roles", TextBox1.Text),
            new SqlParameter("@Status", DropDownList3.SelectedValue),
            new SqlParameter("@DispatcherCovering", DropDownList4.SelectedValue));
            
        Label1.Text = "Entry Saved";
        ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Added');window.location.href = window.location.href;", true);
        ClearAllData();
    }
    else
    {
        Label1.Text = "Fill In All Fields";
    }
}

protected void Button2_Click(object sender, EventArgs e)
{
    string updateSql = "UPDATE Dispatcher_Roles SET Position = @Position, Roles = @Roles, Status = @Status, DispatcherCovering = @DispatcherCovering WHERE Name = @Name";
    ExecuteSqlCommand(updateSql,
        new SqlParameter("@Name", DropDownList1.SelectedValue),
        new SqlParameter("@Position", DropDownList2.SelectedValue),
        new SqlParameter("@Roles", TextBox1.Text),
        new SqlParameter("@Status", DropDownList3.SelectedValue),
        new SqlParameter("@DispatcherCovering", DropDownList4.SelectedValue));
        
    ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Updated');window.location.href = window.location.href;", true);
    ClearAllData();
}

protected void Button3_Click(object sender, EventArgs e)
{
    string deleteSql = "DELETE FROM Dispatcher_Roles WHERE Name = @Name";
    ExecuteSqlCommand(deleteSql, new SqlParameter("@Name", DropDownList1.SelectedValue));
    
    ScriptManager.RegisterStartupScript(this, this.GetType(), "script", "alert('Successfully Deleted');window.location.href = window.location.href;", true);
    ClearAllData();
}

protected void Button5_Click(object sender, EventArgs e)
{
    using (SqlConnection con = new SqlConnection("Data Source=ucpdapps2;Initial Catalog=OnCallWeb;Integrated Security=True"))
    {
        con.Open();
        string selectSql = "SELECT * FROM Dispatcher_Roles WHERE Name = @Name";
        using (SqlCommand comm = new SqlCommand(selectSql, con))
        {
            comm.Parameters.AddWithValue("@Name", DropDownList5.SelectedValue);
            using (SqlDataReader r = comm.ExecuteReader())
            {
                if (r.Read())
                {
                    DropDownList1.SelectedValue = r["Name"].ToString();
                    DropDownList2.SelectedValue = r["Position"].ToString();
                    TextBox1.Text = r["Roles"].ToString();
                    DropDownList3.SelectedValue = r["Status"].ToString();
                    DropDownList4.SelectedValue = r["DispatcherCovering"].ToString();
                }
            }
        }
    }
}

protected void Button6_Click(object sender, EventArgs e)
{
    ClearAllData();
}

protected void TextBox1_TextChanged(object sender, EventArgs e)
{

}
}

内容的提问来源于stack exchange，提问作者Walter G

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
火山引擎 最新活动
全面开放
Doubao-Seedance-2.5全新模型升级

模型再升级,30秒超长叙事, 模态参考扩容

HOT
方舟Codingplan

模型自由，工具不限，最新支持 Deepseek-V4 系列、GLM-5.3 系列

HOT
方舟Agent plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列

HOT
新用户特惠专场

大模型19元起，Al应用9.9元畅享，新人首购爆款尽享优惠

最近更新时间：2026.07.18 07:47:02