防止SQL注入-参数化SQL例代码asp.net

最新推荐文章于 2018-04-27 11:18:07 发布

原创最新推荐文章于 2018-04-27 11:18:07 发布 · 516 阅读

0 ·

CC 4.0 BY-SA版权

数据库相关专栏收录该内容

2 篇文章

订阅专栏

本文介绍了一个使用C#和SQL进行数据更新和插入的例子。包括如何构建SQL语句来更新现有记录以及如何插入新记录。展示了参数化查询的使用以避免SQL注入攻击。

/// <summary> /// 更新一条数据 /// </summary> public void Update(Web.Model.T_Class model) { StringBuilder strSql = new StringBuilder(); strSql.Append("update T_sadfsd set "); strSql.Append("CName=@CName,"); strSql.Append("CFatherID=@CFatherID"); strSql.Append(" where CID=@CID "); SqlParameter[] parameters = { new SqlParameter("@CID", SqlDbType.Int,4), new SqlParameter("@CName", SqlDbType.NVarChar,50), new SqlParameter("@CFatherID", SqlDbType.Int,4)}; parameters[0].Value = model.CID; parameters[1].Value = model.CName; parameters[2].Value = model.CFatherID; DbHelperSQL.ExecuteSql(strSql.ToString(), parameters); }

=========================================================================================================================

     
      string
       sql 
      =
       
      "
      insert into S_Admin(UserName,Password,Remark,Mail,DepartId,Power)values(@UserName,@Password,@Remark,@Mail,@DepartId,@Power)
      "
      ;
        SqlConnection connection 
      =
       
      new
       SqlConnection();
        connection.ConnectionString 
      =
       
      ""
      ;
      //
      此处设置链接字符串
      

              SqlCommand command 
      =
       
      new
       SqlCommand(sql, connection);
        command.Parameters.Add(
      "
      @UserName
      "
      ,SqlDbType.NVarChar, 
      60
      ).Value 
      =
       userName;
        command.Parameters.Add(
      "
      @Password
      "
      , SqlDbType.NVarChar, 
      60
      ).Value 
      =
       password;
        command.Parameters.Add(
      "
      @Remark
      "
      , SqlDbType.NVarChar, 
      60
      ).Value 
      =
       remark;
        command.Parameters.Add(
      "
      @Mail
      "
      , SqlDbType.NVarChar, 
      60
      ).Value 
      =
       mail;
        command.Parameters.Add(
      "
      @DepartId
      "
      , SqlDbType.Int, 
      4
      ).Value 
      =
       departId;
        command.Parameters.Add(
      "
      @Power
      "
      , SqlDbType.Int, 
      4
      ).Value 
      =
       power;
        connection.Open();
        
      int
       rowsAffected 
      =
       command.ExecuteNonQuery();
        connection.Close();
        command.Dispose();
        
      return
       rowsAffected 
      >
       
      0
      ;

     
     
      =========================================================================================================================