C # SQL Injection prevention

In fact, the most thorough anti-SQL Injection Method for sqlserver is to set a user for each database, but it is more troublesome to set specific permissions for this user.

1. When passing parameters to the Get method;
For Integer Parameters: Use
Try {
Int para = int. Parse (Request. QueryString ["id"]. ToString ());
} Catch (Exception ex ){
}

If it is a string parameter: you only need to replace the single quotation marks:
String pata = Request. QueryString ["id"]. ToString (). Replace ("'","");

If paging is involved
My approach is generally:
The parameters passed by Get are hard query conditions:
Construct a query string and store it in the hidden domain of the page;
In this case, the prevention method for SQL injection is to first convert the single quotation marks in this hidden field into other formats: for example @
Then, it will be transferred back during use.
When binding:
Protected void BindDataProject (){
// Replace some special characters that may cause serious consequences with a sentence that will no longer form special characters: xyz; to prevent some people from using the drodropp format, after replacing the drop in the middle, another drop is formed.
Hiddenfield. Value = Regex. Replace (Hiddenfield. Value, @ "'| update | create | alter | delete | drop | backup | truncate | exec | grant ",
"Xyz", RegexOptions. IgnoreCase );

// Convert all the processed single quotes (converted to @) back;
String QueryStr = Regex. Replace (Hiddenfield. Value, @ "@ +", "@", RegexOptions. IgnoreCase). Replace ("@","'");

// Process the parameters of the Get method.
String GetStr = ..........................

String SQL = "select * from *** where 1 = 1" + QueryStr + GetStr;

Then, use the SQL statement to query.
}

Because the conversion is required, the method for clicking the button during query is as follows:
Protected void lblsearch_Click (object sender, EventArgs e) // simple query
{
String xmmc = txtXMmc3.Value. Trim (). Replace ("'", ""); // remove single quotes
String xmmc1 = txtXMmc1.Value. Trim ();

SQL = getSqlStr (SQL, "Donator", xmmc, "string", "like ");
SQL = getSqlStr (SQL, "", xmmc1, "numeric", "= ");

Hidconditoin. Value = SQL. Replace ("'", "@"); // convert the Special Character single quotation marks into other non-special characters first :@,
BindDataProject ();
}

// SQL settings
/*
* ** SrcSQL: original SQL statement
* ** FieldName: database field name
* ** FeildVal: database Field Value
* ** DataType: Field Type
* ** OPtype: operator such as =, <, <=, like
*/
Private string getSqlStr (string srcSQL, string fieldName, string feildVal, string dataType, string OPtype ){//
If (string. isnullorempty (feildval. Trim ())){
Return srcsql;
}
Else {
Feildval = feildval. Trim (); // Replace (/(^ \ s *) | (\ s * $)/g ,"");
Switch (datatype ){
Case "numeric": // numeric type
If (! Isnumeric (feildval )){
Return srcsql;
}
Return srcSQL + "and" + fieldName + "" + OPtype + "" + feildVal;
Case "string ":
Return srcSQL + "and" + fieldName + "" + OPtype + "'%" + feildVal + "% '";

Case "datetime ":
If (! IsDateTime (feildVal ))
{
Return srcSQL;
} Else {
Return srcSQL + "and" + fieldName + "" + OPtype + "'" + feildVal + "'";
}

Case "stringEqu": // equivalent string class
Return srcSQL + "and" + fieldName + "" + OPtype + "'" + feildVal + "'";

Default:
Return srcSQL;
}
}
}
Public bool IsNumeric (string str)
{
Try {decimal. Parse (str );}
Catch {return false ;}
Return true;
}
Public bool IsDateTime (string str)
{
Try {DateTime. Parse (str );}
Catch {return false ;}
Return true;
}