asp.net中过滤掉非法字符的方法

  SqlCommand com = new SqlCommand("select count(*) from loginInfo where Name= @name and Pass=@ps", con);
                com.Parameters.Add(new SqlParameter("@name", SqlDbType.VarChar, 50));
                com.Parameters["@name"].Value = TextName.Text;
                com.Parameters.Add(new SqlParameter("@ps", SqlDbType.VarChar, 50));
                com.Parameters["@ps"].Value = FormsAuthentication.HashPasswordForStoringInConfigFile(TextPass.Text, "MD5");

 SqlParameter表示SqlCommand的参数

 

public static void Sql_Operation(string userID)
 2    { 
 3        using (SqlConnection myConncetion = new SqlConnection(ConfigurationManager.AppSettings["ConnString"]))
 4        using (SqlCommand myCommand = new SqlCommand("select UserID, UserName, UserPwd from WHERE userID = @userID ", myConncetion))
 5        {
 6            try
 7            {
 8                SqlParameter myParameter = new SqlParameter("@userID",SqlDbType.Int,4);
 9                myParameter.Value = Int32.Parse(userID);
10                myCommand.Parameters.Add(myParameter);
11                myConncetion.Open();
12                myCommand.ExecuteNonQuery();
13            }
14            catch (Exception err)
15            {
16                throw new Exception("Err info:"+err.Message.ToString())
17            }
18            finally
19            {
20                myDataAdapter.Dispose();
21                myConncetion.Close();
22                myConncetion.Dispose();
23            }
24        }
25    }