避免SQL注入，使用ADO.NET参数化查询

using System;

using System.Collections.Generic;

using System.ComponentModel;

using System.Data;

using System.Drawing;

using System.Linq;

using System.Text;

using System.Threading.Tasks;

using System.Windows.Forms;

using System.Data.SqlClient;



namespace WindowsFormsApplication1

{

    public partial class Form1 : Form

    {

        int falsesTimes = 0;

        public Form1()

        {

            InitializeComponent();

        }



        private void Form1_Load(object sender, EventArgs e)

        {



        }



        private void btnEsc_Click(object sender, EventArgs e)

        {

            // Application.Exit();直接结束整个应用程序

            this.Close();//只关闭当前窗口，不关闭应用程序

        }



        private void btnLogin_Click(object sender, EventArgs e)

        {

            string name = txtName.Text.Trim();

            string pwd = txtPwd.Text;

            string connectionString = "server=.;database=Test;integrated security=true";

            #region 超过三次，退出

            //using (SqlConnection connection = new SqlConnection(connectionString))

            //{



            //    connection.Open();

            //    string sql = "select count(1) from UserInfo where name='{0}' and pwd='{1}'";

            //    sql = String.Format(sql, name, pwd);

            //    using (SqlCommand cmd = new SqlCommand(sql, connection))

            //    {

            //        int count = Convert.ToInt32(cmd.ExecuteScalar());

            //        if (count > 0)

            //        {

            //            MessageBox.Show("登陆成功");

            //        }

            //        else

            //        {

            //            MessageBox.Show("登录失败");

            //            falsesTimes++;

            //            if (falsesTimes >= 3)

            //            {

            //                MessageBox.Show("登录失败次数过多，系统自动关闭");

            //                this.Close();

            //            }

            //        }

            //    }

            //}

            #endregion



            #region 锁定账号

            using (SqlConnection connection = new SqlConnection(connectionString))

            {



                connection.Open();

                //参数化查询

                //1、参数必须是@开头的，2.不能用引号引住这些参数

                string sql = "select count(1) from UserInfo where name=@name and pwd=@password and DATEDIFF(hour,lockTime,GETDATE())>=24";



                using (SqlCommand cmd = new SqlCommand(sql, connection))

                {

                    //第一种参数化查询方式

                    //SqlParameter spName = new SqlParameter("@name", name);

                    //cmd.Parameters.Add(spName);

                    //SqlParameter spPwd = new SqlParameter("@password", pwd);

                    //cmd.Parameters.Add(spPwd);

                    //第二种参数化查询方式

                    SqlParameter [] spList=new SqlParameter[2];

                    spList[0] = new SqlParameter("@name", name);

                    spList[1] = new SqlParameter("@password", pwd);

                    cmd.Parameters.AddRange(spList);

                    int count = Convert.ToInt32(cmd.ExecuteScalar());

                    if (count > 0)

                    {

                        MessageBox.Show("登陆成功");

                    }

                    else

                    {



                        sql = "select count(1) from UserInfo where name='{0}' and pwd='{1}'";

                        sql = String.Format(sql, name, pwd);

                        cmd.CommandText = sql;

                        count = Convert.ToInt32(cmd.ExecuteScalar());

                        if (count > 0)

                        {

                            MessageBox.Show("被锁定");

                        }

                        else

                        {

                            falsesTimes++;

                            MessageBox.Show("登录失败,你还有" + (3 - falsesTimes) + "次机会");



                            if (falsesTimes >= 3)

                            {

                                MessageBox.Show("登录失败次数过多，系统自动关闭");

                                sql = "update UnserInfo set lockTime=getdate() where name='{0}'";

                                sql = String.Format(sql, name);

                                cmd.CommandText = sql;

                                cmd.ExecuteNonQuery();



                                Application.Exit();

                            }

                        }



                    }

                }

            }

            #endregion

        }

    }

}