防SQL注入之SqlParameter的簡單使用[C#]

CSDN最近反映變快了嘛，剛傳的資源，這麼快就顯示出來了。

此例源碼：http://download.csdn.net/source/1245371

來，照例，咱看代碼(爲什麼我貼出來的代碼顯示這麼醜？。。)

 

string strOrderID = this.textBox1.Text.Trim().ToString(); string strCustomerID = this.textBox2.Text.Trim().ToString(); //被SQL注入的拼SQL的句子是這麼寫的 //string strSql = "Select * from [Orders] Where OrderId = '" + strOrderID + "' AND CustomerID = '" + strCustomerID + "'"; //防止SQL注入的拼SQL的句子是這麼寫的 string strSql = "Select * from [Orders] Where OrderId = @strOrderID AND CustomerID = @strCustomerID"; //加sqlParameter變量 SqlCommand myCommand = new SqlCommand(strSql, con); SqlParameter prOrderId = new SqlParameter("@strOrderID", SqlDbType.VarChar, 64); prOrderId.Value = strOrderID; myCommand.Parameters.Add(prOrderId); //加sqlParameter變量 SqlParameter prCustomerID = new SqlParameter("@strCustomerID", SqlDbType.VarChar, 64); prCustomerID.Value = strCustomerID; myCommand.Parameters.Add(prCustomerID);