万恶的SQL注入漏洞

           string strConn = "DataSource=Fanbin-VAIO;Initial Catalog=sales;Integrated Security=True";

          

           Console.WriteLine("请输入用户名");

            stringuserName = Console.ReadLine();

            Console.WriteLine("请输入用户密码");

            stringuserPassword = Console.ReadLine();

            using(SqlConnection conn =new SqlConnection(strConn))

            {

                conn.Open();

                using(SqlCommand cmd = conn.CreateCommand())

                {

                    cmd.CommandText = "select * from t_user where name='" +userName + "'and password='" +userPassword + "'";

                    //cmd.CommandText ="select * from t_user where name=@NM and password=@PW";

                    //cmd.Parameters.Add(newSqlParameter("NM", userName));

                    //cmd.Parameters.Add(newSqlParameter("PW", userPassword));

 

                    SqlDataReaderdr= cmd.ExecuteReader();

                    if(dr.Read())

                    {

                        Console.WriteLine("登陆成功");

                    }

                    else

                    {

                        Console.WriteLine("用户名或密码错误");          

                    }

                }

                Console.ReadLine();

            }