023. ASP. NET parameterized query to prevent SQL injection attacks

1 /// <summary>2     ///parameterized queries prevent SQL injection attacks3     /// </summary>4      Public intChecklogin (stringLoginName,stringloginpwd)5     {6         stringstrSQL ="Select COUNT (*) from tb_loginuser where [email protected] and [email protected]";7SqlConnection conn =NewSqlConnection (configurationmanager.appsettings["Constr"]);8         if(Conn. State.equals (connectionstate.closed))//exist, to determine whether to close9         {TenConn. Open ();//the connection is turned off, re-opened One         } ASqlCommand sqlcom =NewSqlCommand (strSQL, conn); -Sqlcom. Parameters.Add (NewSqlParameter ("@UserName", SqlDbType.NVarChar, -)); -Sqlcom. parameters["@UserName"]. Value =LoginName; theSqlcom. Parameters.Add (NewSqlParameter ("@PassWord", SqlDbType.NVarChar, -)); -Sqlcom. parameters["@PassWord"]. Value =loginpwd; -         inti = (int) sqlcom. ExecuteScalar (); - Conn. Close (); +         returni; -}

023. ASP. NET parameterized query to prevent SQL injection attacks