SqlParameter 防注入 demo

using (SqlConnection con = new SqlConnection(SQLHelper.constr))
            {
                测试，打开连接
                3.打开连接（如果打开数据连接没有问题，表示连接成功）
                con.Open();
                using (SqlCommand cmd = new SqlCommand())
                {
                    //cmd.CommandText = "select count(*) from Student;";
                    //cmd.Connection = con;
                    //string num=cmd.ExecuteScalar().ToString();
                    //Console.WriteLine(num);

                    cmd.CommandText = "select * from Student where name=@name and number=@number";
                    cmd.Connection = con;
                    //cmd.Parameters.Add("@name", SqlDbType.NVarChar, 10).Value = "张三";
                    //cmd.Parameters.AddWithValue("@number",3452);
                    SqlParameter[] sps = new SqlParameter[2] { new SqlParameter {ParameterName="@name",SqlDbType=SqlDbType.NVarChar,Size=10,Value="张三" },new SqlParameter { ParameterName = "@number", SqlDbType = SqlDbType.Int,  Value = 3452 } };
                    cmd.Parameters.AddRange(sps);
                    SqlDataReader reader = cmd.ExecuteReader();
                    while (reader.Read())
                    {
                        Console.WriteLine(reader["number"] + "   " + reader["name"]);
                    }
                }
                //    Console.WriteLine("数据库连接成功");
                4.关闭连接，释放资源
                //con.Close();

                con.Dispose();
                ///
                //string str= "select * from Student";
                //using (SqlDataAdapter dadapter=new SqlDataAdapter(str,con))
                //{
                //    DataTable dt = new DataTable();
                //    dadapter.Fill(dt);
                //    foreach (DataRow item in dt.Rows)
                //    {
                //        Console.WriteLine(item[1].ToString()+"  "+item[2].ToString());
                //    }
                //}
            }