mysql in放置注入_SQL注入参数化带in的处理方法--动态加载

string status = "";

List liststr = new List();

if (this.chkExamStatus.SelectedIndex != -1)

{

for (int i = 0; i < this.chkExamStatus.Items.Count; i++)

{

if (this.chkExamStatus.Items[i].Selected)

{

liststr.Add(chkExamStatus.Items[i].Value);

}

}

//strSql += " AND V.STATUS in (:status)";

strSql += " AND V.STATUS in (";

string strnamelist = string.Empty;

for (int i = 0; i < liststr.Count; i++)

{

string strname = ":status"+i;

strnamelist += strname + ",";

list.Add(new OracleParameter(strname, liststr[i]));

}

strnamelist = strnamelist.TrimEnd(',').ToString();

strSql += strnamelist +")";

}