麻烦各位 帮忙看看购物车漏洞

Question

这个商品页面 添加按钮下的代码    protected void ImageButton1_Click(object sender, ImageClickEventArgs e)
    {
       
        int count = 0;//获取输入的数量并判断有错没有
        try
        {
            int pcount = int.Parse(Label1.Text);
            if(pcount==0)
            {
                MyWrite.ScriptWrite(Page, "Sorry ! We inventory have no this jersey right now,  We will get it soon.");
                return;
            }
            count = int.Parse(Count.Text.Trim());
            if (count == 0)
            {
                MyWrite.ScriptWrite(Page, "Number is entered incorrectly");
                return;
            }
        }
        catch
        {
            MyWrite.ScriptWrite(Page, "Number is entered incorrectly");
            return;
        }
        if (thisid != 0)
        {
            if (MyUi.ShoppingCart(int.Parse(Request.QueryString["id"].ToString()), int.Parse(Count.Text.Trim()), DropDownList1.SelectedValue))//添加到购物车 参数是  商品id,数量,尺码
            {
                Response.Redirect("cart.html");//成功后跳转
            }
            else
            {
                MyWrite.ScriptWrite(Page, "Add failure!");
            }
        }
        public static int thisid; 这个是上面定义的商品id加载时赋值的
    }
       购物车代码    public static bool ShoppingCart(int id, int count, string size)//cookie存值格式   id.数量.尺码,id.数量.尺码      通过“,”分为一个商品信息组   通过“.”分开识别id和数量等
    {
        try
        {
            HttpCookie cookie = HttpContext.Current.Request.Cookies["cart"];
            string newcrat = "";//更新后的购物车的值
            ///判断cookie是否存在  不存在则创建一个
            if (cookie == null)
            {
                cookie = new HttpCookie("cart");
                cookie.Value = id + "." + count + "." + size;
                cookie.Expires = DateTime.Now.AddDays(1);
                HttpContext.Current.Response.Cookies.Add(cookie);
                return true;
            }
            else
            {
                //判断cookie是否为空  为空的话 直接存值
                if(cookie.Value=="")
                {
                    cookie.Value = id + "." + count + "." + size;
                    cookie.Expires = DateTime.Now.AddDays(1);
                    HttpContext.Current.Response.Cookies.Add(cookie);
                    return true;
                }
                string isbool = "";//判断商品是否已经在购物车
                string crat = HttpContext.Current.Request.Cookies["cart"].Value;
                string[] products = crat.Split(',');
                ///查找该商品是否已经存在于购物车中 
                for (int i = 0; i < products.Length;i++ )
                {
                    string[] product = products[i].ToString().Split('.');
                    int thisid = int.Parse(product[0].ToString());
                    int thiscount = int.Parse(product[1].ToString());
                    string thissize = product[2].ToString();
                    //如果有相同商品且尺码相等  合并显示
                    if(thisid==id&&size==thissize)
                    {
                        thiscount = thiscount + count;
                        isbool = "0";
                    }                    newcrat = newcrat + "," + thisid + "." + thiscount + "." + thissize;
                }
                //不存在 则添加到尾部
                if(isbool!="0")
                {
                    newcrat = newcrat + "," + id + "." + count + "." + size;
                }
                cookie.Value = newcrat.Substring(1,newcrat.Length-1);
                cookie.Expires = DateTime.Now.AddDays(1);
                HttpContext.Current.Response.Cookies.Add(cookie);//保存cookie
                return true;
            } 
        }
        catch( Exception e)
        {
            MySqlConn.MistakeAdd("购物车出错"+e.ToString());//出错信息添加到数据库
            return false;
        }
    }
  购物车用datalist绑定
<asp:DataList ID="DataList1" runat="server" Width="100%" DataKeyField="id" 
            onitemdatabound="DataList1_ItemDataBound"> 
        <ItemTemplate>
            <div class="divbroder">
            <table style=" width:100%">
                 <tr>
                    <td style=" width:100px">
                        <asp:Image ID="Image1" Width="96px" Height="96px" runat="server" ImageUrl='<%# Eval("图片地址") %>' /></td>
                    <td style=" width:400px">
                        <div style=" width:300px">
                          <a href='<%# "../"+Eval("球员名").ToString().ToLower().Replace(" ","-")+"-jerseys/"+Eval("商品名").ToString().ToLower().Replace(" ","-").Replace("'","")+"-"+Eval("id")+".html" %>'>  <asp:Label ID="Label1" runat="server" Text='<%# Eval("商品名") %>'></asp:Label></a> </div>
                    </td>
                    <td style=" width:100px">
                                <asp:DropDownList ID="DropDownList1" runat="server" 
                                    onselectedindexchanged="DropDownList1_SelectedIndexChanged" 
                                    AutoPostBack="True" style="height: 22px">
                                 </asp:DropDownList>
                                <asp:HiddenField ID="HiddenField1" runat="server" Value='<%# Eval("id") %>' />
                                <asp:HiddenField ID="HSize" runat="server" Value='<%# Eval("size") %>' />
                        
                                <asp:HiddenField ID="ProductClass" runat="server" Value='<%# Eval("商品类型") %>' />
                        
                    </td>
                    <td style=" width:100px">
                                 <asp:TextBox ID="Count" runat="server" Width="50px" 
                                     ontextchanged="Count_TextChanged" AutoPostBack="True" 
                                     Text='<%# Eval("count") %>'></asp:TextBox>
                                 <asp:HiddenField ID="HiddenField2" runat="server" 
                                     Value='<%# Eval("count") %>' />
                                 <asp:HiddenField ID="HiddenField3" runat="server" Value='<%# Eval("面向人群") %>' />
                       </td>
                    <td style=" width:100px">
                        $<asp:Label ID="Price" runat="server"  Text='<%# Eval("price") %>'></asp:Label></td>
                    <td style=" width:100px"> $<asp:Label ID="SumPrice" runat="server"  Text='<%# Eval("sumprice") %>'></asp:Label></td>
                    <td style=" width:100px">
                        <asp:LinkButton ID="LinkButton1" runat="server" onclick="LinkButton1_Click">Delete</asp:LinkButton></td>
                </tr>
            </table>
            </div>
        </ItemTemplate>
        </asp:DataList>这上面的  就是 添加到购物车并显示的代码
上次遇到的是 点击添加到购物车时出错了  错误不详

Answer 1

   绑定购物车代码
    protected void BindData()
    {
        DataSet ds = MyUi.MyCart();
        DataList1.DataSource = ds;
        DataList1.DataBind();
        if(ds==null)
        {
            DivBool.Visible = true;
            Dtable.Visible = false;
        }
    }
    public static DataSet MyCart()
    {
        HttpCookie cookie = HttpContext.Current.Request.Cookies["cart"];
        if (cookie == null||cookie.Value=="")
        {
            return null;
        }
        else
        {
            string sql = "";//select id,商品名,价格2,count=价格2*2,size='xl' 图片地址 where id=2
            string cookiestr = cookie.Value.ToString();
            string[] prodcuts = cookiestr.Split(',');
            int count=0;
            for (int i = 0; i < prodcuts.Length;i++ )
            {
                string[] prodcut=prodcuts[i].ToString().Split('.');
                int id=int.Parse(prodcut[0].ToString());
                int thiscount=int.Parse(prodcut[1].ToString());
                string size=prodcut[2].ToString();
                count = count + thiscount;
                sql = sql + "union all select id,图片地址,商品名,球员名,面向人群,商品类型,count="+thiscount+",价格2 as price,sumprice=价格2 * " + thiscount + ",size='" + size + "' from prodcuts where id=" + id + "";
            }
            if(count>=10)
            {
                sql = sql.Replace("价格2", "价格3");
            }
            return ProdcutDAL.MyDataset(sql.Substring(9, sql.Length - 9));
        }
    }
   返回尺码表的代码
    public static DataTable ProdcutSize(int code)
    {
        string man = "M(48),L(50),XL(52),2XL(54),3XL(56),5XL(60)";
        string women = "S(46),M(48),L(50),XL(52),2XL(54)";
        string kids = "S,M,L,XL";
        string hat = "7,71/8,71/4,73/8,71/2,75/8,73/4";
        DataTable tab = new DataTable();
        string[] msizes = man.Split(',');
        string[] ksizes = kids.Split(',');
        string[] hatsize = hat.Split(',');
        string[] womens = women.Split(',');
        tab.Columns.Add(new DataColumn("size", typeof(string)));
        if (code == 0)
        {
            for (int i = 0; i < msizes.Length; i++)
            {
                DataRow dr = tab.NewRow();
                dr[0] = msizes[i].ToString().Trim();
                tab.Rows.Add(dr);
            }
            return tab;
        }
        else if (code == 1)
        {
            for (int i = 0; i < womens.Length; i++)
            {
                DataRow dr = tab.NewRow();
                dr[0] = womens[i].ToString();
                tab.Rows.Add(dr);
            }
            return tab;
        }
        else if (code == 2)
        {
            for (int i = 0; i < ksizes.Length; i++)
            {
                DataRow dr = tab.NewRow();
                dr[0] = ksizes[i].ToString();
                tab.Rows.Add(dr);
            }
            return tab;
        }
        else
        {
            for (int i = 0; i < hatsize.Length; i++)
            {
                DataRow dr = tab.NewRow();
                dr[0] = hatsize[i].ToString();
                tab.Rows.Add(dr);
            }
            return tab;
        }
    }