Database Operations (anti-injection attacks)

Using System;
Using System.Collections.Generic;
Using System.Linq;
Using System.Text;
Using System.Threading.Tasks;
Using System.Data.SqlClient;

namespace ConsoleApplication1
{
Class Program
{
static void Main (string[] args)
{
Console.WriteLine ("Please enter the vehicle code to be queried:");
String code = Console.ReadLine ();
SqlConnection conn = new SqlConnection ("server=.; database=mydb;user=sa;pwd=1023823348 ");
SqlCommand cmd = conn. CreateCommand ();
cmd.commandtext = "SELECT * from car where [email protected]";
cmd. Parameters.clear ();
cmd. Parameters.addwithvalue ("@code", code);
Conn. Open ();
SqlDataReader dr = cmd. ExecuteReader ();
if (Dr. HasRows)
{
While (Dr. Read ())
{
Console.WriteLine (Dr[0] + "--" + dr[1]);
Console.WriteLine ("Input 1 Delete this data input 2 modify data input 3 Add data");
}
int a = Int. Parse (Console.ReadLine ());
Dr. Close ();
if (a = = 1)
{
cmd.commandtext = "Delete from car where [email protected]";
cmd. ExecuteNonQuery ();
Console.WriteLine ("Delete succeeded! ");
}
else if (a = = 2)
{
Console.WriteLine ("Please enter Content");
String name = Console.ReadLine ();
cmd.commandtext = "Update car set [email protected] where [email protected]";
cmd. Parameters.clear ();
cmd. Parameters.addwithvalue ("@name", name);
cmd. Parameters.addwithvalue ("@code", code);
cmd. ExecuteNonQuery ();
Console.WriteLine ("Modified successfully! ");
}
else if (a = = 3)
{
Console.WriteLine ("Please enter");
string code2 = Console.ReadLine ();
Console.WriteLine ("Please enter the content name");
String name = Console.ReadLine ();
Console.WriteLine ("Please enter serial number");
string brand = Console.ReadLine ();
Console.WriteLine ("Please enter the content date");
string time = Console.ReadLine ();
Console.WriteLine ("Please enter content fuel consumption *.**");
double oil =double. Parse (Console.ReadLine ());
Console.WriteLine ("Please enter the content horsepower");
int powers = Int. Parse (Console.ReadLine ());
Console.WriteLine ("Please enter Content");
int exhaust = Int. Parse (Console.ReadLine ());
Console.WriteLine ("Please enter Content");
double Price =double. Parse (Console.ReadLine ());
Console.WriteLine ("Please enter Content");
string pic = Console.ReadLine ();

Cmd.commandtext = "INSERT into car values (@code, @name, @brand, @time, @oil, @powers, @exhaust , @price, @pic)";
cmd. Parameters.clear ();
cmd. Parameters.addwithvalue ("@code", Code2);
cmd. Parameters.addwithvalue ("@name", name);
cmd. Parameters.addwithvalue ("@brand", brand);
cmd. Parameters.addwithvalue ("@time", time);
cmd. Parameters.addwithvalue ("@oil", oil);
cmd. Parameters.addwithvalue ("@powers", Powers);
cmd. Parameters.addwithvalue ("@exhaust", exhaust);
cmd. Parameters.addwithvalue ("@price", price);
cmd. Parameters.addwithvalue ("@pic", pic);
cmd. ExecuteNonQuery ();
Console.WriteLine ("added successfully! ");
}
Else
{
Console.WriteLine ("Error");
}
}
Else
{
Console.WriteLine ("No corresponding data found");
}

Conn. Close ();
console.readline ();

}
}

}

Database Operations (anti-injection attacks)