字符条件变成in条件格式数据

private string getInQuerySql(string query)
{
string resulr = "";
foreach (var item in query.Split(','))
{
resulr += LibSysUtils.QuoteStr(item);
resulr += ",";
}
return resulr.TrimEnd(',');
}

 

/// <summary>
/// SQL替换单引号，防止注入
/// </summary>
/// <param name="value"></param>
/// <returns></returns>
public static string QuoteStr(string value)
{
if (string.IsNullOrEmpty(value))
return "''";

value = value.Replace("'", "''");
return string.Format("'{0}'", value);
}

转载于:https://www.cnblogs.com/deepalley/p/10288800.html