C # anti-SQL Injection for like condition during SQL statement Splicing

C # anti-SQL Injection for like condition during SQL statement Splicing

This afternoon, my colleague asked me a basic question. What should I do if I encounter Like when splicing SQL statements.

My original writing method was simple concatenation of strings. Later, my colleague asked me what to do if I encountered SQL injection. This is indeed a problem.

I just found related instructions on the Internet. It was originally written in this way.

Such as an SQL statement:

Select * from game where gamename like '% three %'

In c # format:

String keywords = "James"; StringBuilder strSql = new StringBuilder (); strSql. append ("select * from game where gamename like @ keywords"); SqlParameter [] parameters = new SqlParameter [] {new SqlParameter ("@ keywords ", "%" + keywords + "% "),};

Although % is used here, it is quite simple and practical to filter SQL Injection effectively.

It is a small knowledge point and I hope it will help you! Pai_^