SQL学习笔记[1] - 防注入攻击：一个参数传值+模糊查询的参考写法

OracleConnection conn = new OracleConnection(ConfigurationManager.ConnectionStrings["ConnStr_Ora"].ConnectionString);
            conn.Open();
            OracleCommand cmd = new OracleCommand("select VENDOR_REF,NAME,SHORT_NAME,SITE,ADDRESS,COMMENTS,S_CONTACT,POST_OR_ZIP,TELEPHONE,FAX,CAUTION_TEXT FROM SCP" + schema_proj + ".VDB_VENDORS WHERE NAME LIKE :vendor AND COMMENTS LIKE :specialty AND CAUTION_TEXT LIKE :isQualified ORDER BY VENDOR_REF", conn);

            cmd.Parameters.Add(new OracleParameter("vendor", OracleType.VarChar, 60));
            cmd.Parameters["vendor"].Value = "%" + vendor_name + "%";
            cmd.Parameters.Add(new OracleParameter("specialty", OracleType.VarChar, 20));
            cmd.Parameters["specialty"].Value = "%" + dll_specialty.SelectedValue + "%";
            cmd.Parameters.Add(new OracleParameter("isQualified", OracleType.VarChar, 20));
            cmd.Parameters["isQualified"].Value = "%" + dll_isQulified.SelectedValue + "%";

            OracleDataAdapter sad = new OracleDataAdapter(cmd);
            DataSet ds = new DataSet();
            sad.Fill(ds);
            gv.DataSource = ds;
            gv.DataBind();
            conn.Close();