Ado. NET prevent string attack methods

Use splicing statements to attack data when entering content in a black window

Example: Enter class value

--: on behalf of the contents are commented out

preventing SQL injection attacks Method :

When the command is sent to the SQL statement two times sent, the SQL statement into two pieces, the user input is a piece, the first time to write a CommandText SQL statements in the past; the second time the value of the variable is sent past, to match

" update Users Set [email protected]pwd "

Cmd. Parameters.addwithvalue ("@pwd", PWD);

Chestnuts:

usingSystem;usingSystem.Collections.Generic;usingSystem.Data.SqlClient;usingSystem.Linq;usingSystem.Text;namespaceupdate{classProgram {Static voidMain (string[] args) {            BOOLhas =false;//determines whether the input data exists, True indicates existence, false does not existConsole.Write ("Please enter the user name you want to modify:"); stringuname =Console.ReadLine (); SqlConnection Conn=NewSqlConnection ("server=.; Database=data0928;user=sa;pwd=123"); SqlCommand cmd=Conn.            CreateCommand (); Cmd.commandtext="Select *from Users where UserName = '"+ uname +"'"; Conn.            Open (); SqlDataReader Dr=cmd.            ExecuteReader (); if(Dr. HasRows)//If this user information is found{ has=true;//Change the intermediate variable to true to prove that you have this message} conn.            Close (); if(HAS)//If you have this information, you need to make a deletion decision{Console.Write ("This user information has been found, do you want to modify it? (y/n)"); stringU = console.readline ();//record the user's actions                if(U.toupper () = ="Y")//Determine the user action, if y, to delete{Console.Write ("Please enter the password to be modified:"); stringPWD =Console.ReadLine (); Console.Write ("Please enter the nickname you want to modify:"); stringNick =Console.ReadLine (); Console.Write ("Please enter the gender to be modified:"); stringSex =Console.ReadLine (); Console.Write ("Please enter the birthday you want to modify:"); stringBir =Console.ReadLine (); Console.Write ("Please enter the people you want to modify:"); stringNation =Console.ReadLine (); Console.Write ("Please enter the class to be modified:"); stringCLA =Console.ReadLine (); //make **= a variableCmd.commandtext ="update Users Set [email protected],[email protected],[email protected],[email protected],[email protected],[email protected] where [email protected]"; Cmd. Parameters.clear ();//to clear a bound variable, it is best to write a purge before using the parameter collection//format: cmd. Parameters.addwithvalue ("@**", * *); How many columns are they tied to?Cmd. Parameters.addwithvalue ("@pwd", PWD); Cmd. Parameters.addwithvalue ("@nick", Nick); Cmd. Parameters.addwithvalue ("@sex", Sex); Cmd. Parameters.addwithvalue ("@bir", BIR); Cmd. Parameters.addwithvalue ("@nation", Nation); Cmd. Parameters.addwithvalue ("@cla", CLA); Cmd. Parameters.addwithvalue ("@uname", uname); Conn.                    Open (); //perform an action and record the number of rows affectedcmd.                    ExecuteNonQuery (); Conn.                    Close (); Console.WriteLine ("modified successfully! "); }                Else//user chooses not to delete{Console.WriteLine ("Modify Cancel! "); }            }            Else//No user information found, Judge Has=false{Console.WriteLine ("User name Input Error! This user information is not found! ");        } console.readkey (); }    }}

ADO. NET prevents string attack methods