SQL防注入

第一种

01 namespace DemoConsoleApplication

02  {
03       class   Program
04       {
05           //数据库连接字符串、根据实际修改
06           private   const   string   ConnectionString   =   @"Data Source=|DataDirectory|\Database1.sdf" ;
07 
08           static   void   Main ( string []   args )
09           {
10               //获取用户输入的内容
11               Console . WriteLine ( "请输入用户名" );
12               string   Passport   =   Console . ReadLine ();
13               Console . WriteLine ( "请输入密码" );
14               string   Password   =   Console . ReadLine ();
15 
16               using  ( SqlConnection   Conn   =   new   SqlConnection ( ConnectionString ))
17               {
18                   Conn . Open ();  //打开数据库
19                   using  ( SqlCommand   Cmd   =   Conn . CreateCommand ())
20                   {
21                       Cmd . CommandText   =   "select * from TB_Users where passport=@UN and password=@PWD" ;
22                       Cmd . Parameters . Add ( new   SqlParameter ( "UN" ,   Passport ));
23                       Cmd . Parameters . Add ( new   SqlParameter ( "PWD" ,   Password ));
24 
25                       if  ( 1   ==   Cmd . ExecuteNonQuery ())
26                           Console . WriteLine ( "登陆成功！" );
27                       else
28                           Console . WriteLine ( "登陆失败！" );
29                   }
30               }
31 
32               Console . ReadKey (); //防止控制台程序一闪而过、而看不到输出结果
33           }
34       }

35 }

第二种

 Public Sub InsertAll(TaskName As String, TaskState As String, TaskStartPage As Integer, TaskEndPage As Integer, TaskPage As Integer, TaskUrl As String)
        Try
            DB.Execute("insert into T_Task (TaskName,TaskState,TaskStartPage,TaskEndPage,TaskPage,TaskUrl) values ('" & TaskName.Replace("'", "''") & "','" & TaskState.Replace("'", "''") & "'," & TaskStartPage & "," & TaskEndPage & "," & TaskPage & ",'" & TaskUrl & "')")
        Catch ex As Exception
            If ex.Message.Contains("UNIQUE") Then
                MsgBox("该任务名已占用")
            End If
        End Try
    End Sub