Use parameters instead of string concatenation for forming SQL queries,用参数方式来生成sql语句,而不是用连接字符串的方式...

String concatenation is not a secure approach as clever person can execute unwanted SQL statement by some tricks (SQL injection attack). Use parameters if possible.

Bad code:

    SqlCommand command = new SqlCommand("SELECT COUNT(*) FROM Accounts WHERE Login='" + login + "' AND Password='" + password + "'", conn);

Good code:

    SqlCommand command = new SqlCommand("SELECT COUNT(*) FROM Accounts WHERE Login=@login AND Password=@password", conn);

    SqlParameter param = new SqlParameter("login", SqlDbType.VarChar, 100);

    param.Value = login;

    command.Parameters.Add(param);

    param = new SqlParameter("password", SqlDbType.VarChar, 100);

    param.Value = password;

    command.Parameters.Add(param);

转载于:https://www.cnblogs.com/josephshi/archive/2008/01/15/1040006.html