Is your program prone to SQL injection?

A person to a unit to develop a platform, after the development, according to the regular release to the external network server operation, the customer to the Administrator account, password told someone, this is to give someone convenient pre-test data.

Someone logged in often to see if the platform was all right, and never found any problems. But after a few months, someone thought of the platform to look up some data, but forget the password, how can not think of, and not good at asking customers to, so think of SQL injection, open their own write the source code login statement, as follows:

SELECT * from S_user where username= ' {0} ' and userpwd= ' {1} '

Someone look, if you want to log in illegally, it is not difficult!!!

In the User Name text box, type: admin '--

The last sign-in statement is as follows:

SELECT * from S_user where username= ' admin '--' and userpwd= ' {1} '

This is equivalent to querying only the user name, and password verification is commented!!!

Click Login, and indeed login success! Oh, my God!!!! How can this be???

At this point, I think there should be a lot of people besides someone else's program exists this problem! Does your program have this kind of problem?

Is your program prone to SQL injection?