预防1'or'1'='1SQL注入,使用参数

 1    private void button1_Click(object sender, RoutedEventArgs e)
 2         {
 3             using (SqlConnection conn = new SqlConnection("Data Source=.;Initial Catalog=master;User ID=sa;Password=123456;"))
 4             {
 5                 conn.Open();
 6                 using (SqlCommand cmd = conn.CreateCommand())
 7                 {
 8                     cmd.CommandText = "select waterwork from Table_1 where othersnum=@num";
 9                     cmd.Parameters.Add(new SqlParameter("@num", textBox1.Text));
10                     using (SqlDataReader reader = cmd.ExecuteReader())
11                     {
12                         while (reader.Read())
13                         {
14                             string work = reader.GetString(0);
15                             MessageBox.Show(work);
16                         }
17                     }
18                 }
19             }
20         }
View Code

 

posted @ 2013-09-02 16:30  垂坠  阅读(1086)  评论(0编辑  收藏  举报