【发布时间】:2010-07-31 23:21:19
【问题描述】:
string connectionString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\\Samples\\login.mdb";
String uname, pass;
uname = textBox1.Text;
pass = textBox2.Text;
OleDbConnection myConnection = new OleDbConnection(connectionString);
myConnection.Open();
String query = "insert into LOGIN_TABLE (UserName, Password) VALUES ('" +
textBox1.Text.ToString() + "','" + textBox2.Text.ToString() + "') ";
OleDbCommand myCommand = new OleDbCommand();
myCommand.CommandText = query;
OleDbParameter myParm = myCommand.Parameters.Add("@uname", OleDbType.VarChar, 50);
myParm.Value = textBox1.Text;
myParm = myCommand.Parameters.Add("@pass", OleDbType.VarChar, 50);
myParm.Value = textBox2.Text;
myCommand.ExecuteNonQuery();
myConnection.Close();
【问题讨论】:
-
query只是乞求进行 SQL 注入...你意识到你没有使用参数,是吗?
标签: c#