C # parameterized execution of SQL statements to prevent vulnerability attacks this article takes MySql as an example [20151108 non-query operations ],

C # parameterized execution of SQL statements to prevent vulnerability attacks this article takes MySql as an example [20151108 non-query operations ],

Why do we need to execute SQL statements in parameters?

One function is to prevent user injection vulnerabilities.

Let's just give a column.

For example, if the account and password are used for logon,

Simply write the data from the database to find the data with the same id and pw as the user input.

SQL: select id, pw where id = 'inputtid' and pw = 'inputpw ';

Generally, there is no problem. However, if the user input id or PW tape ', this may cause a vulnerability and a bug.

For example, the id entered by the user is: 1 'or '1' = '1

This is the SQL statement execution: select id, pw where id = '1' or '1' = '1' and pw = 'inputpw ';

All the accounts and passwords in the database meet this condition.

In short, you can use 'to change the execution of your SQL statement.

Parameterization can avoid this problem.

 

 

 

/************************ Non-query operations ************ **************************** // It is too late today, write a non-query operation first, and write the query operation tomorrow. /***** Function ***** // <summary> // add, delete, and modify data, and the number of affected rows is returned, -1 // </summary> /// <param name = "SQL"> SQL statement </param> /// <param name = "ps"> parameter </param> /// <returns> Number of affected rows returned </returns> static string connStr = "server = IP; user Id = Account Name; password = password; Database = table name "; public static int ExecuteNonQuery (string SQL, params MySqlParameter [] ps) {using (MySqlConnection conn = new MySqlConnection (connStr) {using (MySqlCommand cmd = new MySqlCommand (SQL, conn) {cmd. parameters. addRange (ps); conn. open (); return cmd. executeNonQuery (); // returns the number of affected rows }}/ ***** application example *****/public void InsertData () {int cid = 1, aid = 2; string name = "hha"; string SQL = "insert into tb_compart (compartID, compartName, areaID) values (@ compartID, @ compartName, @ areaID );"; mySqlParameter [] ps = {new MySqlParameter ("@ compartID", (object) cid), new MySqlParameter ("@ compartName", name), new MySqlParameter ("@ areaID ", (object) aid)}; int r = Mysql. mySQLHelper. executeNonQuery (SQL, ps); // The r value is the number of affected rows. Execution failed r =-1 ;}}