防止注入的sql调用

最新推荐文章于 2024-11-03 09:30:00 发布

weixin_30480651

最新推荐文章于 2024-11-03 09:30:00 发布

阅读量62

点赞数

文章标签：数据库

原文链接：http://www.cnblogs.com/achun/archive/2008/03/01/1087585.html

版权

int KeChengHao = int.Parse(this.textBox1.Text.Trim());

System.Data.SqlClient.SqlConnection con = new System.Data.SqlClient.SqlConnection("Data Source=127.0.0.1;Initial Catalog=Student;User ID=sa;PassWord=58");

System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand("delete from 课程表 where 课程号=@课程号", con);
cmd.CommandType = CommandType.Text; //防止这样注入 delete from 课程表 where 课程号=1 or 1=1

System.Data.SqlClient.SqlParameter p = new System.Data.SqlClient.SqlParameter("@课程号", SqlDbType.Int, 4);
p.Value = KeChengHao;

cmd.Parameters.Add(p);

            con.Open();
            int changeline = cmd.ExecuteNonQuery();
            con.Close();

label2.Text = "数据库更改行数" + changeline.ToString();

转载于:https://www.cnblogs.com/achun/archive/2008/03/01/1087585.html