SQL statement security and query efficiency

Insertstr = "insert into userinfo (name, password, email, phone, mobile, post, address)

Values (''";

Insertstr + = This. _ name. Trim ()

; + "'',''";

Insertstr + = This. _ password. Trim () + "'',''";

Insertstr + = This. _ email. Trim () + "'',''";

Insertstr + = This. _ phone. Trim () + "'',''";

Insertstr + = This. _ mobile. Trim () + "'',''";

Insertstr + = This. _ post. Trim () + "'',''";

Insertstr + = This. _ address. Trim () + "'')";

 

1. efficiency problems

First look at the above sectionCode, The efficiency is too low. The efficiency of so many string connections is low enough. In addition, there is no need to add such trim.

2. Security

Same as above, I can do a lot of things with single quotes, such as running an xp_cmd command, you will be miserable.

So, how to write it? The above code can be changed to this:

Reference content is as follows:

 

String strsql = "insert into sometable (C1, C2, C3,...) values (@ C1, @ C2,

@ C3 ,...)"

Sqlcommand mycommand = new sqlcommand (strsql, myconn)

Try

{

Mycommand. Parameters. Add (New sqlparameters ("@ C1", sqldatatype. varchar, 20)

Mycommand. Parameters ["@ C1"]. value = This. _ name;

....

 

}

Catch (...)

...

 

This method can avoid inefficient string connections and use sqlcommand parameter validity detection to avoid invalid characters. This parameter method is pre-compiled with high efficiency.