使用 SqlCommand.Parameters.AddWithValue填充SQL语句中的参数@SNO。防止SQL攻击

DataSet ds = new DataSet();
// 定义查询语句
string sql = “SELECT SNO, SName, Gender, Birthday, Mobile, Email, HomeAddress, PhotoPath FROM Student where SNO LIKE @SNO AND SName Like @SName AND Mobile Like @Mobile”;//
if (cmbSex.Text.Contains(“女”))
{
sql += " and Gender=‘女’ ";
}
else if (cmbSex.Text.Contains(“男”))
{
sql += " and Gender=‘男’ ";
}
SqlCommand cmd = new SqlCommand(sql, conn);

        cmd.Parameters.AddWithValue("@SNO", txtID.Text.Trim()+"%");
        cmd.Parameters.AddWithValue("@SName",  txtName.Text.Trim()+"%" );
        cmd.Parameters.AddWithValue("@Mobile", txtMoblie.Text.Trim()+ "%" );
        SqlDataAdapter sda = new SqlDataAdapter(cmd);

        //打开
        conn.Open();
        sda.Fill(ds, "Student");
        conn.Close();
        dgvStudent.DataSource = null;
        dgvStudent.DataSource = ds.Tables["Student"];