SQL注入漏洞攻击

protected void Button1_Click(object sender, EventArgs e)
        {
            string connstr = "data source=WIN-10AFVI27V7T;initial catalog=UserDB1;user id=sa;password=admin;";
            using (SqlConnection con = new SqlConnection(connstr))
            {
               // string sql = string.Format("select count(*) from T_Users where FuserName='{0}' and FPassword='{1}'",txtUserName.Text.Trim(),txtPassword.Text.Trim());
               //以上这种拼接Sql语句方法有Sql注入的漏洞供给问题 jk' or 1=1 --
                // 如何避免注入漏洞攻击呢？ 使用参数的方法或存储过程方法

                string sql = "select count(*) from T_Users where FuserName=@username and FPassword=@password";
               
                using (SqlCommand cmd = new SqlCommand(sql, con))
                {
                    con.Open();
                                      SqlParameter[] pms=new SqlParameter[]
                    {
                        new SqlParameter("@username",txtUserName.Text.Trim()),
                        new SqlParameter("@password",txtPassword.Text.Trim())
                    };

                    cmd.Parameters.AddRange(pms);
                       

                    //通过监视发现，ADO的参数替换方法避免了注入漏洞攻击，他通过一个存储过程实现了把输入的字符串作为处理格式
                    //在sql中，把'单引号转义为字符串的方法是前面再加一个单引号。

                    //在sql中的参数都是以@开始的，
                    int r = Convert.ToInt32(cmd.ExecuteScalar());  //把sql语句送到数据服务器端执行。
                    con.Close();//可以提前关闭连接，提高效率。

                    if (r > 0)
                    {
                        Response.Write("登陆成功！");
                    }
                    else
                    {
                        Response.Write("登录失败！");
                    }
                }

            }
        }