使用 method 的 SQL 命令中的参数化查询-解网

问：

现在我想把它变成一个参数化查询，这样它就不容易发生SQL注入。代码如下：

 string sqlText = "SELECT @EmployeeColumn FROM Test_Attachments WHERE Project_Id = @PID1 AND [Directory] = '" + qAttachment.Directory1.Replace("\\\\" + Root_Directory, "") + "' ";

 try 
 {
     SqlCommand myCommand = new SqlCommand(sqlText, SqlConnection);

     myCommand.Parameters.AddWithValue("EmployeeColumn", Employee_Column);
     myCommand.Parameters.AddWithValue("PID1", Project_ID1");
 }
 .....

如何使查询参数化？尤其是方法。谢谢

编辑：不好意思。我是在手机上输入的，所以它有很多错别字。谢谢！

C# asp.net sql-server sql-injection parameterized-query

string sqlText = "SELECT {{columnName}} FROM Test_Attachments WHERE Project_Id =@PID1 AND [Directory] = @Directory";

var allowedColumns = new List<string>{"columnA", "columnB"};

if(allowedColumns.Contains(Employee_Column)
{
   sqlText = sqlText.Replace("{{columnName}}", Employee_Column);
} 
else
{
   throw new Exception($"Invalid Column {Employee_Column}");
}

try {
    SqlCommand myCommand = new SqlCommand(sqlText, SqlConnection);

    var directory = qAttachment.Directory1.Replace("\\\\" + Root_Directory, "");

     myCommand.Parameters.AddWithValue("@PID1", Project_ID1);
     myCommand.Parameters.AddwithValue("@Directory", directory);

     ...
}

使用 method 的 SQL 命令中的参数化查询

Parameterized Query in SQL command with method

评论

评论