C#防止SQL注入的MYSQL连接方法 原理：参数化查询

 public static DataSet sql(string sql, Dictionary<string, object> parameters)
        {
            //连接字符串
            string connection = "";
            DataSet DataSet = new DataSet();
            DataTable DataTable = new DataTable();
            MySqlConnection con = new MySqlConnection(connection);
            con.Open();
            MySqlCommand cmd = new MySqlCommand(sql, con);
            foreach (KeyValuePair<string, object> parameter in parameters)
            {
                cmd.Parameters.AddWithValue(parameter.Key, parameter.Value);
            }
            MySqlDataAdapter sqlData = new MySqlDataAdapter(cmd);
            sqlData.Fill(DataTable);
            DataSet.Tables.Add(DataTable);
            con.Close();
            return DataSet;
        }

使用实例：

  Dictionary<string, object> parameters = new Dictionary<string, object>();
        public void instance(string user_id) {

            parameters.Add("@user_id", user_id);
            string sql = "select * from Product where user_id=@user_id";
            package.sql(sql, parameters);
        }