Compiling the sqlhelper class in c #(2 ),

Compiling the sqlhelper class in c #(2 ),

The previous article talked about the compilation of the simple SqlHelper class. Here we will write a solution to the problem raised at the end of the previous article.

SQL statement injection attacks are already well known. How can we protect our databases from such attacks in C?

Don't worry, c # already provides a good solution, that is, the SqlParameter class.

How to use it?

　　

Class SqlHelper {

Public object ExecuteScalar (string SQL, Parameter [] parameters) // an array of the Parameter type is added here.
Using (SqlConnection conn = new SqlConnection (connStr ))
{
Conn. Open ();
Using (SqlCommand cmd = conn. CreateCommand ())
{
Cmd. CommandText = SQL;
Foreach (Parameter param in parameters) // traverses the passed array and adds the elements to the query one by one.
{
Cmd. Parameters. add (param );
}
SqlDataAdapter adapter = new SqlDataAdapter (cmd); // The data adapter uses query as its own attribute.
DataSet dataset = new DataSet (); // create a cache
Adapter. Fill (dataset); // store data in the cache.
Return dataset; // a collection of returned data.
}
}
}

The preceding example uses the Parameter class to protect SQL statements and prevent SQL injection.

But another point is that we define an array as a parameter in the method. What if the input is not just an array?

At this time, we need to use the variable length parameter concept.

Variable Length Parameter definition method:

Static int sum (int [] arr) // This is a simple function definition with fixed parameter length.
{
Int sum = 0;
Foreach (int I in arr)
{
Result + = I;
}
Return result;
}
Static int sum1 (param int [] arr) // This is a simple function definition with variable parameter length.
{
Int result = 0;
Foreach (int I in arr)
{
Result + = I;
}
Return result;
}
Static void Main (string [], args)
{
Int [] array1 = new int [] {1, 2, 3, 4, 5 };
Sum (array1); // we use the fixed parameter length method. An array must be passed in.
Sum1 (, 10); // you can use the variable parameter length method to transfer numbers as needed. The function automatically adds them to its own array parameters.
}

I will write it here today. The specific use of variable length parameters in SqlHelper will be explained in the next article.