防止sql注入 参数化解决方案

StringBuilder strSql=new StringBuilder(); strSql.Append("insert into T_SysLog("); strSql.Append("UserID,UserName,LogContent,CreateTime"); strSql.Append(") values ("); strSql.Append("@UserID,@UserName,@LogContent,@CreateTime");
strSql.Append(") ");
strSql.Append(";select @@IDENTITY");
SqlParameter[] parameters = {
new SqlParameter("@UserID", SqlDbType.NVarChar,20) ,
new SqlParameter("@UserName", SqlDbType.NVarChar,50) ,
new SqlParameter("@LogContent", SqlDbType.Text) , new SqlParameter("@CreateTime", SqlDbType.DateTime)
};
parameters[0].Value = model.UserID;
parameters[1].Value = model.UserName;
parameters[2].Value = model.LogContent;
parameters[3].Value = model.CreateTime;