参数化查询防止Sql注入

拼接sql语句会造成sql注入,注入演示

namespace WindowsFormsApp1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            FillData(dataGridView1);
        }

        private void FillData(DataGridView dataGrid)
        {
            string connStr = ConfigurationManager.ConnectionStrings["Northwind"].ConnectionString;
            using (SqlConnection conn = new SqlConnection(connStr))
            {
                string sql = "select * from Employees where EmployeeID=\'" + textBox1.Text + "\'";
                using (SqlCommand sqlCommand = new SqlCommand(sql, conn))
                {
                    using (SqlDataAdapter sqlData = new SqlDataAdapter(sqlCommand))
                    {
                        DataTable dataTable = new DataTable();
                        sqlData.Fill(dataTable);
                        dataGrid.DataSource = dataTable;
                    }
                }
            }
        }
    }
}

View Code