参数化查询

参数化查询的优势：

        可以增强代码的安全性



// ---------------------------------------配置文件----------------------------------------------------------------------------

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <startup>
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
    </startup>
  <connectionStrings>
    <add name="sql" connectionString="server=.;database=MySecondDB;uid=sa;pwd=520;"/>
  </connectionStrings>
</configuration>

//---------------------------------------Program.cs-------------------------------------------------------------------------

using System;
using System.Collections.Generic;
using System.Configuration;
using System.Data.SqlClient;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace 参数化登陆
{
    class Program
    {
        static void Main(string[] args)
        {
            // 用户输入
            Console.WriteLine("uid:");
            string uid = Console.ReadLine();
            Console.WriteLine("pwd:");
            string pwd = Console.ReadLine();

            // 验证
            string connStr = ConfigurationManager.ConnectionStrings["sql"].ConnectionString;

            // 1 修改sq语句
            string sql = "select count(*) from loginPrimaryTest where uid=@uid123 and pwd=@pwd;";

            // 2 参数赋值
            SqlParameter pUid = new SqlParameter("@uid123", uid);
            SqlParameter pPwd = new SqlParameter("@pwd", pwd);

            //
            int count;
            using (SqlConnection conn = new SqlConnection(connStr))
            {
                using (SqlCommand cmd = new SqlCommand(sql, conn))
                {
                    // 3 将参数交给cmd
                    cmd.Parameters.Add(pUid);
                    cmd.Parameters.Add(pPwd);
                    conn.Open();
                    count = (int)cmd.ExecuteScalar();
                }
            }

            if (count > 0)
            {
                Console.WriteLine("登陆成功");
            }
            else
            {
                Console.WriteLine("登陆失败");
            }

            Console.ReadKey();
        }
    }
}