使用带参数的sql语句防止sql注入
public insert(string name)
{
string sql="insert into category(name) values(@name)";
SqlParameter[] paras=new SqlParameter[]{
new SqlParameter("@name",name)
};
ExecuteNonQuery(sql,paras);
}
_____________________________________________________________________________
public ExecuteNonQuery(string sql,SqlParameter[] paras)
{
using(cmd=new SqlCommand(sql,Getconn))
{
cmd.Parameters.AddRange(paras);
cmd.ExecuteNonQuery();
}
}