ASP.NET MVC中View页面Guid传递为空问题求助

我有一张名为Shipment的表，主键（PK）数据类型是uniqueidentifier（对应C#中的Guid）。我制作了一个查询Shipment数据的View页面，查询结果里的ActionLink可引导用户进入编辑页面查看并编辑数据。但点击链接时，从搜索页传递到编辑页的是空Guid（00000000-0000-0000-0000-000000000000），手动将主键复制粘贴到URL中时，文本框能正常显示对应列的数据。需要指导如何在View页面正确传递Guid并读取对应数据。

编辑页面控制器代码（更新控制器正常，未附上） #

//get shipment info
public ActionResult Edit(Guid id)
{
    List<Shipment> shipments = new List<Shipment>();
    Shipment shipment = new Shipment();
    using (SqlConnection con = new SqlConnection(connectonString))
    {
        var query = "SELECT * FROM Shipments where sSUID = @SSuid";
        //var query = "SELECT * FROM Shipments where sSUID = '" + id + "'";

        SqlCommand cmd = new SqlCommand(query, con);
        cmd.Parameters.Add("@SSuid", SqlDbType.UniqueIdentifier).Value = id;
        con.Open();
        
        SqlDataReader dr = cmd.ExecuteReader();
        if (dr.Read())
        {
            shipment.SSuid = (Guid)dr["SSuid"];
            //shipment.SSuid = dr.GetGuid(dr.GetOrdinal("SSuid").ToString());
            shipment.SFrom = Convert.ToString(dr["SFrom"]);
            //shipment.SSuid = Guid.Parse(dr["SSuid"].ToString());
            //shipment.SSuid = (Guid).Parse(dr["SSuid"].ToString());
            //shipment.SSuid = (Guid)dr["SSuid"].ToString();
            shipment.SCompanyName = Convert.ToString(dr["SCompanyName"]);
            shipment.SFname = Convert.ToString(dr["SFname"]);
            shipment.SMname = Convert.ToString(dr["SMname"]);
            shipment.SLname = Convert.ToString(dr["SLname"]);
            shipment.SFrom = Convert.ToString(dr["SFrom"]);
            shipment.SAddress1 = Convert.ToString(dr["SAddress1"]);
            shipment.SAddress2 = Convert.ToString(dr["SAddress2"]);
            shipment.SCity = Convert.ToString(dr["SCity"]);
            shipment.SState = Convert.ToString(dr["SState"]);
            shipment.SPostalCode = Convert.ToString(dr["SPostalCode"]);
            shipment.SCountry = Convert.ToString(dr["SCountry"]);

            //shipments.Add(shipment);
        }

        con.Close();
    }

    return View(shipment);
}

搜索页传递Guid的ActionLink代码 #

@Html.ActionLink("Edit", "Edit", new {id=shipment.SSuid}) |
@*@Html.ActionLink("Edit", "Edit", new {id=shipment.SSuid.ToString()})*@ 

编辑页View代码 #

@model Receiving.Models.Shipment;
@{
    Layout = "~/Views/Shared/_Layout.cshtml";
}

@using (Html.BeginForm(new { @class = "form-horizontal" }))
{
    @Html.AntiForgeryToken()
    ;
<div class="form-row">
        @Html.HiddenFor(m => m.SSuid)
        @Html.TextBoxFor(m => m.SSuid, new { @class = "form-control", tabindex = 1 })

    </div>
}

更新：搜索控制器代码（问题根源） #

发现是搜索控制器读取Guid时返回空值，但其他数据正常，以下是搜索函数代码：

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult SearchByTrackingNumber(string? TrackingNumber ) {
    List<Shipment> shipments = new List<Shipment>();
    using(SqlConnection con = new SqlConnection(connectonString))
    {
        con.Open();
        String sql = "select * from Shipments inner join Packages on Shipments.sSUID = Packages.pSUID where pTrackingNumber like'%" + TrackingNumber + "%' order by sDateReceived";
        SqlCommand cmd = new SqlCommand(sql, con);

        using (SqlDataReader reader = cmd.ExecuteReader())
        {
            while (reader.Read())
            {
                Shipment shipment = new Shipment();
                //shipment.SSuid = reader.GetGuid(reader.GetOrdinal("SSuid").ToString());
                //shipment.SSuid = Guid.Parse(reader["SSuid"]).ToString();
                Guid guid = new Guid(reader["SSuid"].ToString());//This is not working
                shipment.SCompanyName = Convert.ToString(reader["SCompanyName"]);
                shipment.SFname = Convert.ToString(reader["SFname"]);
                shipment.SMname = Convert.ToString(reader["SMname"]);
                shipment.SLname = Convert.ToString(reader["SLname"]);
                shipment.SFrom = Convert.ToString(reader["SFrom"]);
                shipment.SAddress1 = Convert.ToString(reader["SAddress1"]);
                shipment.SAddress2 = Convert.ToString(reader["SAddress2"]);
                shipment.SCity = Convert.ToString(reader["SCity"]);
                shipment.SState = Convert.ToString(reader["SState"]);                            
                shipment.SPostalCode = Convert.ToString(reader["SPostalCode"]);
                shipment.SCountry = Convert.ToString(reader["SCountry"]);
                
                shipments.Add(shipment);
            }
            con.Close();
        }
    }

    return View(shipments); 
}

解决方案 #

1. 修复Guid赋值逻辑 #

搜索控制器中，你创建了guid变量但并未赋值给shipment.SSuid，同时错误地将Guid转为字符串再解析，替换为直接读取Guid的方式：

// 替换原Guid读取代码
shipment.SSuid = reader.GetGuid(reader.GetOrdinal("SSuid"));

2. 修复SQL注入漏洞 #

原搜索SQL使用字符串拼接存在注入风险，改用参数化查询：

String sql = "select * from Shipments inner join Packages on Shipments.sSUID = Packages.pSUID where pTrackingNumber like @TrackingNumber order by sDateReceived";
SqlCommand cmd = new SqlCommand(sql, con);
cmd.Parameters.Add("@TrackingNumber", SqlDbType.NVarChar).Value = "%" + TrackingNumber + "%";

3. 确认ActionLink传递逻辑 #

搜索页的ActionLink可直接传递Guid类型，保持原代码即可：

@Html.ActionLink("Edit", "Edit", new {id=shipment.SSuid})

完成以上修改后，搜索结果中的shipment.SSuid会被正确赋值，点击Edit链接时即可将有效Guid传递到编辑页面，编辑页就能正常读取对应数据。

内容的提问来源于stack exchange，提问作者smbbb