参数化SQL语句一定程度上防止SQL注入

  public bool InsertAdmin(string userName, string password, string remark, string mail, int departId, int power)ÆïǾLâ½íwww.netcsharp.cnQfòç=û\
    {
        string sql = "insert into S_Admin(UserName,Password,Remark,Mail,DepartId,Power)values(@UserName,@Password,@Remark,@Mail,@DepartId,@Power)";
        SqlConnection connection = new SqlConnection();
        connection.ConnectionString = "";//此处设置链接字符串
        SqlCommand command = new SqlCommand(sql, connection);
        command.Parameters.Add("@UserName",SqlDbType.NVarChar, 60).Value = userName;       

        command.Parameters.Add("@Password", SqlDbType.NVarChar, 60).Value = password;
        command.Parameters.Add("@Remark", SqlDbType.NVarChar, 60).Value = remark;
        command.Parameters.Add("@Mail", SqlDbType.NVarChar, 60).Value = mail;       

        command.Parameters.Add("@DepartId", SqlDbType.Int, 4).Value = departId;
        command.Parameters.Add("@Power", SqlDbType.Int, 4).Value = power;     

        connection.Open();
        int rowsAffected = command.ExecuteNonQuery();        connection.Close();        command.Dispose();
        return rowsAffected > 0;
    }
}

转载于:https://www.cnblogs.com/renjuwht/archive/2009/07/17/1525930.html