String. Format does not prevent SQL injection attacks.

Private void StringFormat ()
{
String userName = "jirigala ";
String password = "123456 ";
String sqlQuery = string. Format ("SELECT * FROM Base_User WHERE UserName = {0} AND UserPassword = {1}", userName, password );
// Open a database through Interface Definition
IDbHelper dbHelper = new SqlHelper ();
// Open the database connection according to the specified database connection string
DbHelper. Open ("Server = JIRIGALA-PC; Database = UserCenterV30; Uid = sa; Pwd = sa ;");
DbHelper. ExecuteNonQuery (sqlQuery );
DbHelper. Close ();
}

After receiving a reply from a blog user, I always think string. Format cannot prevent injection attacks. string. Format is not so magical.

Looking at the original article, on the surface, it is absolutely not to prevent SQL injection attacks. Unless it is processed at the underlying layer, it is obvious that there are injection attacks. The source code is as follows:

Code
Protected void btnLogin_Click (object sender, EventArgs e)
{
MAction action = new MAction (TableNames. Users );
If (action. fill (string. format ("UserName = {0} and Password = {1}", txtUserName. text. trim (), txtPassword. text. trim ())))
{
Session ["ID"] = action. Get <int> (Users. ID );
Action. Close ();
Response. Redirect ("Default. aspx ");
}
Else
{
LbMsg. Text = "incorrect user password! ";
Action. Close ();
}
}