Some methods to prevent SQL Injection

SQL injection is exploited by malicious users.ProgramSome input SQL statements are concatenated to attack, and values are parameterized to effectively prevent SQL injection. However, sometimes not all SQL statements have to be written and stored. For example, some simple SQL statements are unnecessary. In this case, we can also parameterize the values to solve the possibility of being injected! For example:

String SQL = "insert into table (name, sex, address, age) values (@ name, @ sex, @ address, @ age );"; sqlparameter [] parame = new sqlparameter [] {New sqlparameter ("@ name", modal. name), new sqlparameter ("@ sgex", modal. sex), new sqlparameter ("@ address", modal. address), new sqlparameter ("@ age", modal. age )};

Remember to add it after the SQL statement to avoid the possibility of SQL statement appending.