private string getInQuerySql(string query)
{
string resulr = "";
foreach (var item in query.Split(','))
{
resulr += LibSysUtils.QuoteStr(item);
resulr += ",";
}
return resulr.TrimEnd(',');
}
/// <summary>
/// SQL替换单引号，防止注入
/// </summary>
/// <param name="value"></param>
/// <returns></returns>
public static string QuoteStr(string value)
{
if (string.IsNullOrEmpty(value))
return "''";
value = value.Replace("'", "''");
return string.Format("'{0}'", value);
}