## DBHelper参数化命令（预防注入攻击）

DBHelper参数化命令（预防注入攻击）

SQL注入攻击：利用接收用户输入的数据，对SQL语句进行字符串的拼接

防止SQL注入：避免用户进行SQL语句的字符串拼接
1、禁止对SQL命令进行加号或占位符的拼接
2、将需要接收用户输入的地方使用SQL变量（@name）
｝

#region  非参数化命令
        public static object DHDL(string sql)
        {
            using (SqlConnection con=new SqlConnection(str))
            {
                SqlCommand cmd = new SqlCommand(sql, con);
                con.Open();
                return cmd.ExecuteScalar();
            }
        }

        public static int ZSG(string sql)
        {
            using (SqlConnection con = new SqlConnection(str))
            {
                SqlCommand cmd = new SqlCommand(sql, con);
                con.Open();
                return cmd.ExecuteNonQuery();
            }
        }

        public static SqlDataReader DQQ(string sql)
        {
            using (SqlConnection con = new SqlConnection(str))
            {
                SqlCommand cmd = new SqlCommand(sql, con);
                con.Open();
                return cmd.ExecuteReader(CommandBehavior.CloseConnection);
            }
        }

        public static DataTable SPQ(string sql)
        {
            SqlConnection con = new SqlConnection(str);
            SqlDataAdapter sda = new SqlDataAdapter(sql, str);
            DataTable dt = new DataTable();
            sda.Fill(dt);
            return dt;
        }
        #endregion


        #region 参数化命令
        public static object DHDL(string sql ,SqlParameter [] ps)
        {
            using (SqlConnection con = new SqlConnection(str))
            {
                SqlCommand cmd = new SqlCommand(sql, con);
                cmd.Parameters.AddRange(ps);
                con.Open();
                return cmd.ExecuteScalar();
            }
        }

        public static int ZSG(string sql, SqlParameter[] ps)
        {
            using (SqlConnection con = new SqlConnection(str))
            {
                SqlCommand cmd = new SqlCommand(sql, con);
                cmd.Parameters.AddRange(ps);
                con.Open();
                return cmd.ExecuteNonQuery();
            }
        }

        public static SqlDataReader DQQ(string sql, SqlParameter[] ps)
        {
            using (SqlConnection con = new SqlConnection(str))
            {
                SqlCommand cmd = new SqlCommand(sql, con);
                cmd.Parameters.AddRange(ps);
                con.Open();
                return cmd.ExecuteReader(CommandBehavior.CloseConnection);
            }
        }

        public static DataTable SPQ(string sql, SqlParameter[] ps)
        {
            SqlConnection con = new SqlConnection(str);
            SqlDataAdapter sda = new SqlDataAdapter(sql, str);
            sda.SelectCommand.Parameters.AddRange(ps);
            DataTable dt = new DataTable();
            sda.Fill(dt);
            return dt;
        }
        #endregion