Parameterized SQL statements to prevent SQL injection attacks

There are two ways to prevent SQL injection attacks:

1) The first is that all SQL statements are stored in the stored procedure, which not only avoids SQL injection, but also improves performance. In addition, the stored procedure can have a dedicated database administrator (DBA) writing and centralized management; however, this method sometimes has different query conditions for the same tables, and SQL statements may be different, so that a large number of stored procedures will be written. So there is the second query method,

2) SQL statements for parameterized Query

Example:

// Instantiate the connection object sqlconnection con = new sqlconnection ("database connection string "); // Add a database connection string // instantiate the command object sqlcommand cmd = new sqlcommand ("select * From userinfo where sex = @ sex and age = @ age", con ); // sqlcommand cmd = con. createcommand (); // cmd. commandtext = "select * From userinfo where sex = @ sex and age = @ age"; // The first example is cmd. parameters. addwithvalue ("@ sex", true); // example of sqlparameter parameter = new sqlparameter ("@ age", sqldbtype. INT); parameter. value = 30; cmd. parameters. add (parameter); // Add parameters // instantiate dataadapter sqldataadapter adapter = new sqldataadapter (CMD); datatable DATA = new datatable ();