SQL 注入 处理

SqlHelper.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

public static class SqlHelper
{
    /// <summary>
    /// 替换SQL特殊字符
    /// </summary>
    /// <param name="obj">需序转化的对象</param>
    /// <returns></returns>
    public static string ToMSSQL(this String obj)
    {
        return obj.Replace("'", "''").Replace("[", "[[]").Replace("%", "[%]").Replace("_", "[_]");
    }
}

View Code