(2) How C # ADO solves SQL Injection vulnerability attacks

SQL injection is a way for a user to submit an SQL statement to the server via a client request Get or post, and spoof the servers to execute a malicious SQL statement. For example, the following SQL statement:

1 " SELECT * from t_stuff where name = ' "+txtbox1.text+"";

Where Txtbox1 is a TextBox control, we normally enter a name in this TextBox control to query the employee's information. However, if a user maliciously enters a concatenation string in this TextBox control, for example: "1 ' or ' 1 ' = ' 1", then this query statement will look like this:

1 " SELECT * FROM student where name = ' 1 ' or ' 1 ' = ' 1 ' "

In this case, it would be a great hazard to query all the information of all the employees in the database anyway. For this problem, you can use the placeholder method to solve. We made improvements using the Add method of the parameters in the SqlCommand class, with the following code:

1 " SELECT * from student where name [email protected] " ; 2 cmd. Parameters.Add (new SqlParameter ("@name", TextBox1.Text));

◇parameters mechanism mainly in the database of the response column, query whether there is a character after the @, this time again in the TextBox input similar to "1 ' or ' 1 ' = ' 1" character has no effect. The character arguments that follow the ◇@ cannot be used to replace information such as keywords, but can only be used to replace the specific value of an item that exists in the database, that is, the "=" number behind it.

(2) How C # ADO solves SQL Injection vulnerability attacks