C # prevents SQL injection from being reproduced

C # prevents SQL injection attackshttp://blog.csdn.net/limlimlim/article/details/8629582 L Login Judgment: SELECT * from T_users where username= ... and password= ..., the parameters are spelled into the SQL statement. L Construct a malicious password:hello ' or 1=1-- L if (Datareader.read ()) L { l MessageBox.Show ("landing Success"); L} L Else L { l MessageBox.Show ("Landing failed"); L} l Prevention of injection vulnerability attacks: Do not use SQL statement stitching, parameter assignment

String constr = "Data source=zxtiger;initial catalog=itcastcn;integrated security=true";
using (SqlConnection con = new SqlConnection (CONSTR))
{
String sql = "SELECT COUNT (*) from Userlogin where[email protected]and[email protected]";
using (SqlCommand cmd = new SqlCommand (sql, con))
{
Tell the Command object before execution @uid and @pwd who will replace it in the future.
Assigning values to variable @uid and @pwd
Cmd. Parameters.addwithvalue ("@uid", TxtUid.Text.Trim ());
Cmd. Parameters.addwithvalue ("@pwd", Txtpwd.text);
#region Myregion
SqlParameter p1 = new SqlParameter ("@uid", TxtUid.Text.Trim ());
Cmd. Parameters.Add (p1);

                    //sqlparameter p2 = new SqlParameter ("@pwd", Txtpwd.text);
                    //cmd. Parameters.Add (p2);
                     #endregion

sqlparameter[] PMS = new sqlparameter[] {
New SqlParameter ("@uid", TxtUid.Text.Trim ()),
New SqlParameter ("@pwd", Txtpwd.text)
};
Cmd. Parameters.addrange (PMS);

Con. Open ();
int r = Convert.ToInt32 (cmd). ExecuteScalar ());
Con. Close ();
if (R > 0)
{
MessageBox.Show ("Login Successful! ");
}
Else
{
MessageBox.Show ("Login failed! ");
}
}
}

C # prevents SQL injection from being reproduced