c# mysql 增删改查 避免sqlparameter_SqlParameter 实现数据库的插入操作，防止sql注入。...

usingSystem;usingSystem.Collections.Generic;usingSystem.Linq;usingSystem.Web;usingSystem.Web.UI;usingSystem.Web.UI.WebControls;usingSystem.Text;usingSystem.Data.SqlClient;usingSystem.Data;usingSystem.Configuration;namespaceParaMeter

{public partial classTest : System.Web.UI.Page

{private string connectionStr; //链接数据库的字符串

private SqlConnection conDB; //数据库的链接

private SqlTransaction _trans; //事务对象

protected void Page_Load(objectsender, EventArgs e)

{//connectionStr = ConfigurationSettings.AppSettings["constr"];

connectionStr = "server=10.11.43.189\\SQL2008;database=OA_WEB_DB;uid=sa;pwd=123456";

conDB= newSqlConnection(connectionStr);

}protected void Button1_Click(objectsender, EventArgs e)

{

StringBuilder strSql= newStringBuilder();

strSql.Append("INSERT INTO [OA_WEB_DB].[dbo].[OA_RT_FileType]([FileTypeName],[Deleted])");

strSql.Append("VALUES(@fileName,@delete)");

SqlParameter[] parameters={new SqlParameter("@fileName", SqlDbType.NVarChar,100),new SqlParameter("@delete",SqlDbType.Bit),

};

parameters[0].Value = "文件类型";

parameters[1].Value = false;bool IsSucc =ExecUpdateSql(strSql.ToString(), parameters);if(IsSucc)

{

Label1.Text= "插入成功";

}else{

Label1.Text= "插入失败";

}

}///执行一条更新语句///

/// 需要执行的SQL语句。

/// 执行参数数组

/// 成功返回True，失败返回False。

private bool ExecUpdateSql(string SQLString, paramsSqlParameter[] cmdParms)

{using (SqlCommand cmd = newSqlCommand())

{try{

PrepareCommand(cmd, conDB, _trans, SQLString, cmdParms);int iret =cmd.ExecuteNonQuery();return true;

}catch(System.Data.SqlClient.SqlException e)

{return false;

}

}

}private void PrepareCommand(SqlCommand cmd, SqlConnection conn, SqlTransaction trans, stringcmdText, SqlParameter[] cmdParms)

{if (conn.State !=ConnectionState.Open)

conn.Open();

cmd.Connection=conn;

cmd.CommandText=cmdText;if (trans != null)

cmd.Transaction=trans;

cmd.CommandType= CommandType.Text;//cmdType;

if (cmdParms != null)

{foreach (SqlParameter parameter incmdParms)

{if ((parameter.Direction == ParameterDirection.InputOutput || parameter.Direction == ParameterDirection.Input) &&(parameter.Value== null))

{

parameter.Value=DBNull.Value;

}

cmd.Parameters.Add(parameter);

}

}

}

}

}