清理 SQL 参数

Question

我有以下 SQL 查询：

var query = @"select EMP.ID, EMP.NAME
        from DB_TEST.DBO.EMPLOYEE as EMP 
        inner join DB_TEST.DBO.DEPARTMENT as DEPT on EMP.ID = DEPT.EMP_ID and DEPT.LANG_CH_TAG = 'english'
        where DEPT.ID = @deptId
        group by EMP.ID, EMP.NAME;";

SqlCommand cmd = new SqlCommand(query, conn);

cmd.Parameters.Add("@deptId", SqlDbType.Int);
cmd.Parameters["@deptId"].Value = 37;

reader = cmd.ExecuteReader();

当这段代码在Sonar下运行时，出现如下错误：

确保清理此 SQL 命令的参数。

我认为通过 cmd.Parameters 传递参数是一种清理它的方法。

请问有什么办法吗？

Answer 1

以下代码是使用 ADO.net 从数据库获取数据的示例：

改变获取参数的方法。

using (SqlConnection conn = new SqlConnection("connectionString")) 
                {
                    using (SqlCommand cmd = new SqlCommand()) 
                    { 
                        cmd.Connection = conn;
                        cmd.CommandType = CommandType.Text;
                        cmd.CommandText = @"select EMP.ID, EMP.NAME
            from DB_TEST.DBO.EMPLOYEE as EMP 
            inner join DB_TEST.DBO.DEPARTMENT as DEPT on EMP.ID = DEPT.EMP_ID and DEPT.LANG_CH_TAG = 'english'
            where DEPT.ID = @deptId
            group by EMP.ID, EMP.NAME;";  

                        cmd.Parameters.AddWithValue("@deptId", deptId);  

                        try
                        {
                            conn.Open();
                          var reader = cmd.ExecuteReader();
                        }
                        catch(SqlException e)
                        {
                            MessgeBox.Show(e.Message.ToString(), "Error Message");
                        }

                    } 
                }