预防1'or'1'='1SQL注入，使用参数

最新推荐文章于 2022-08-20 17:25:36 发布

weixin_33781606

最新推荐文章于 2022-08-20 17:25:36 发布

阅读量723

点赞数

原文链接：http://www.cnblogs.com/chuizhuizhigan/p/3296783.html

版权

 1    private void button1_Click(object sender, RoutedEventArgs e)
 2         {
 3             using (SqlConnection conn = new SqlConnection("Data Source=.;Initial Catalog=master;User ID=sa;Password=123456;"))
 4             {
 5                 conn.Open();
 6                 using (SqlCommand cmd = conn.CreateCommand())
 7                 {
 8                     cmd.CommandText = "select waterwork from Table_1 where othersnum=@num";
 9                     cmd.Parameters.Add(new SqlParameter("@num", textBox1.Text));
10                     using (SqlDataReader reader = cmd.ExecuteReader())
11                     {
12                         while (reader.Read())
13                         {
14                             string work = reader.GetString(0);
15                             MessageBox.Show(work);
16                         }
17                     }
18                 }
19             }
20         }