C# winform prevents sql injection

admin · Posted on 1/29/2015 10:12:59 AM

Pass by parameter:
string sql = "select count(*) from zhuce where username=@username and pwd=@pwd and type = @type";
SqlConnection conn = new SqlConnection(Common.Context.SqlManager.CONN_STRING);
         conn. Open();

         SqlCommand cmd = new SqlCommand(sql, conn);
cmd.Parameters.Add("@username",SqlDbType.VarChar，30);
cmd.Parameters.Add("@pwd",SqlDbType.VarChar，30);
cmd.Parameters.Add("@type",SqlDbType.VarChar，10);
cmd.Parameters["@username"]. Value = username;
cmd.Parameters["@pwd"]. Value = pwd;
cmd.Parameters["@type"]. Value = power. Text;

         int count = Convert.ToInt32(cmd.ExecuteScalar());

         conn. Close();

Not sure what database you are using
Here is a piece of SQL-Server code
The most important thing to prevent injection attacks is not to use splicing parameters, but to use parameter assignment methods.
SqlConnection conn=......
SqlCommand comm =new SqlCommand ("select count (*）from Table1 where name = @loginame and password = @loginpassword",conn);
comm. Parameters.Add(new SqlParameter("@loginame",SqlDbType.NVarchar,20);
comm. Parameters["@loginame"].value=TextBox1.Text;
comm. Parameters.Add(new SqlParameter("@loginpassword",SqlDbType.NVarchar,20);
comm. Parameters["@loginpassword"].value=TextBox2.Text;
comm. Connection.Open();
int mark=(int)comm. ExecuteScalar()
//--mark用于标记

[Communication] C# winform prevents sql injection

Related Posts

Sections viewed