CreateOrUpdateOAuthAccount in WebMatrix.WebData.SimpleMembershipProvider contains the following code:
```
if (oldUserId == -1)
{
// account doesn't exist. create a new one.
int insert = db.Execute(@"INSERT INTO [" + OAuthMembershipTableName + "] (Provider, ProviderUserId, UserId) VALUES (@0, @1, @2)", provider, providerUserId, userId);
if (insert != 1)
{
throw new MembershipCreateUserException(MembershipCreateStatus.ProviderError);
}
}
else
{
// account already exist. update it
int insert = db.Execute(@"UPDATE [" + OAuthMembershipTableName + "] SET UserId = @2 WHERE UPPER(Provider)=@0 AND UPPER(ProviderUserId)=@1", provider, providerUserId, userId);
if (insert != 1)
{
throw new MembershipCreateUserException(MembershipCreateStatus.ProviderError);
}
}
```
Not only will the UPPER() statements in the second query provide poor query performance forcing full table seeks, the comparison in the update differs from the insertion.
Given that at least google's provider userid contains both lower case and upper case letters and is stored such in the database, UPPER() must be a mistake.
```
if (oldUserId == -1)
{
// account doesn't exist. create a new one.
int insert = db.Execute(@"INSERT INTO [" + OAuthMembershipTableName + "] (Provider, ProviderUserId, UserId) VALUES (@0, @1, @2)", provider, providerUserId, userId);
if (insert != 1)
{
throw new MembershipCreateUserException(MembershipCreateStatus.ProviderError);
}
}
else
{
// account already exist. update it
int insert = db.Execute(@"UPDATE [" + OAuthMembershipTableName + "] SET UserId = @2 WHERE UPPER(Provider)=@0 AND UPPER(ProviderUserId)=@1", provider, providerUserId, userId);
if (insert != 1)
{
throw new MembershipCreateUserException(MembershipCreateStatus.ProviderError);
}
}
```
Not only will the UPPER() statements in the second query provide poor query performance forcing full table seeks, the comparison in the update differs from the insertion.
Given that at least google's provider userid contains both lower case and upper case letters and is stored such in the database, UPPER() must be a mistake.