Quantcast
Channel: ASP.NET MVC / Web API / Web Pages
Viewing all articles
Browse latest Browse all 7925

Created Unassigned: CreateOrUpdateOAuthAccount inserts without upper, updates using upper comparison. [1192]

$
0
0
CreateOrUpdateOAuthAccount in WebMatrix.WebData.SimpleMembershipProvider contains the following code:

```
if (oldUserId == -1)
{
// account doesn't exist. create a new one.
int insert = db.Execute(@"INSERT INTO [" + OAuthMembershipTableName + "] (Provider, ProviderUserId, UserId) VALUES (@0, @1, @2)", provider, providerUserId, userId);
if (insert != 1)
{
throw new MembershipCreateUserException(MembershipCreateStatus.ProviderError);
}
}
else
{
// account already exist. update it
int insert = db.Execute(@"UPDATE [" + OAuthMembershipTableName + "] SET UserId = @2 WHERE UPPER(Provider)=@0 AND UPPER(ProviderUserId)=@1", provider, providerUserId, userId);
if (insert != 1)
{
throw new MembershipCreateUserException(MembershipCreateStatus.ProviderError);
}
}
```

Not only will the UPPER() statements in the second query provide poor query performance forcing full table seeks, the comparison in the update differs from the insertion.

Given that at least google's provider userid contains both lower case and upper case letters and is stored such in the database, UPPER() must be a mistake.

Viewing all articles
Browse latest Browse all 7925

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>