C#中的参数化查询[重复]

Question

我怎样才能使它不易发生 SQL 注入？这些代码是向数据库插入数据，很多人说这种格式很容易被SQL注入。

private void DBConn()
{
    string ConString = "datasource = localhost; Username = root; Password=; database = logbook";
    MySqlConnection DBConnnect = new MySqlConnection(ConString);
    try
    {
        DBConnnect.Open();
        MySqlCommand cmd = DBConnnect.CreateCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "insert into tbl_data (Student_Number, Name, Strand, Section) values('"+textBox1.Text+"', '"+textBox2.Text+"', '"+textBox3.Text+"', '"+textBox4.Text+"')";
        cmd.ExecuteNonQuery();
        DBConnnect.Close();
        MessageBox.Show("Student registered successfully");
    }
    catch (Exception e)
    {
        MessageBox.Show(e.Message);
    }
}

Answer 1

像这样……

private void DBConn()
{
    string ConString = "datasource = localhost; Username = root; Password=; database = logbook";
    MySqlConnection DBConnnect = new MySqlConnection(ConString);
    try
    {
        DBConnnect.Open();
        MySqlCommand cmd = DBConnnect.CreateCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "insert into tbl_data (Student_Number, Name, Strand, Section) values(@student_number, @name, @strand, @section)";
        cmd.Parameters.AddWithValue("student_number", textBox1.Text);
        cmd.Parameters.AddWithValue("name", textBox2.Text);
        cmd.Parameters.AddWithValue("strand", textBox3.Text);
        cmd.Parameters.AddWithValue("section", textBox4.Text);
        cmd.ExecuteNonQuery();
        DBConnnect.Close();
        MessageBox.Show("Student registered successfully");
    }
    catch (Exception e)
    {
        MessageBox.Show(e.Message);
    }
}

Answer 2

官方SqlCommand.Parameters Property拥有你所需要的一切。

cmd.CommandText = "INSERT INTO tablename(column1,column2,column3) VALUES(@column1,@column2,@column3)

有一些关于AddWithValue 风险的讨论，因此您可能希望选择 Add(...).Value 方法。

command.Parameters.Add("@column1", SqlDbType.Int).Value = x;
command.Parameters.Add("@column2", SqlDbType.Int).Value = y;
command.Parameters.Add("@column3", SqlDbType.Int).Value = z;

---

您应该使用using 语句。

var commandText = "INSERT INTO tablename(column1,column2,column3) VALUES(@column1,@column2,@column3)

using (SqlConnection connection = new SqlConnection(connectionString))
{
    SqlCommand command = new SqlCommand(commandText, connection);

    command.Parameters.Add("@column1", SqlDbType.Int).Value = x;
    command.Parameters.Add("@column2", SqlDbType.Int).Value = y;
    command.Parameters.Add("@column3", SqlDbType.Int).Value = z;
    try
    {
        connection.Open();
        Int32 rowsAffected = command.ExecuteNonQuery();
        Console.WriteLine("RowsAffected: {0}", rowsAffected);
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}