最新国产好看的视频,伊人天堂AV在线,国产Aaaaaa视频,蜜臀视频在线观看一区,人妻av色图,密臀久久久精品影片,青青视频免费观看毛片,久草在线观看视,国产三级精品色情在线

數(shù)據(jù)庫(kù)SqlParameter 的插入操作,防止sql注入的實(shí)現(xiàn)代碼

 更新時(shí)間:2013年04月22日 15:11:29   作者:  
今天學(xué)習(xí)了一下SqlParameter的用法,原來(lái)這么寫(xiě)是為了防止sql注入,破壞數(shù)據(jù)庫(kù)的。并自己動(dòng)手連接了數(shù)據(jù)庫(kù)。

例子:  點(diǎn)擊Button1按鈕的時(shí)候就把數(shù)據(jù)插入數(shù)據(jù)庫(kù)中。

復(fù)制代碼 代碼如下:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Text;
using System.Data.SqlClient;
using System.Data;
using System.Configuration;

namespace ParaMeter
{
    public partial class Test : System.Web.UI.Page
    {
        private string connectionStr;  //鏈接數(shù)據(jù)庫(kù)的字符串
        private SqlConnection conDB;   //數(shù)據(jù)庫(kù)的鏈接
        private SqlTransaction _trans; //事務(wù)對(duì)象

        protected void Page_Load(object sender, EventArgs e)
        {
            //connectionStr = ConfigurationSettings.AppSettings["constr"];
            connectionStr = "server=10.11.43.189\\SQL2008;database=OA_WEB_DB;uid=sa;pwd=123456";
            conDB = new SqlConnection(connectionStr);
        }

        protected void Button1_Click(object sender, EventArgs e)
        {
            StringBuilder strSql = new StringBuilder();
            strSql.Append("INSERT INTO [OA_WEB_DB].[dbo].[OA_RT_FileType]([FileTypeName],[Deleted])");
            strSql.Append("VALUES(@fileName,@delete)");
            SqlParameter[] parameters = {
                                 new SqlParameter("@fileName", SqlDbType.NVarChar,100),
                                 new SqlParameter("@delete",SqlDbType.Bit),

                             };
            parameters[0].Value = "文件類(lèi)型";
            parameters[1].Value = false;
          bool IsSucc =   ExecUpdateSql(strSql.ToString(), parameters);
          if (IsSucc)
          {
             Label1.Text =  "插入成功";
          }
          else
          {
              Label1.Text = "插入失敗";
          }

        }
        /// 執(zhí)行一條更新語(yǔ)句
        /// </summary>
        /// <param name="SQLString">需要執(zhí)行的SQL語(yǔ)句。</param>
        /// <param name="cmdParms">執(zhí)行參數(shù)數(shù)組</param>
        /// <returns>成功返回True,失敗返回False。</returns>
        private bool ExecUpdateSql(string SQLString, params SqlParameter[] cmdParms)
        {
            using (SqlCommand cmd = new SqlCommand())
            {
                try
                {
                    PrepareCommand(cmd, conDB, _trans, SQLString, cmdParms);
                    int iret = cmd.ExecuteNonQuery();
                    return true;
                }
                catch (System.Data.SqlClient.SqlException e)
                {
                    return false;
                }
            }
        }
        private void PrepareCommand(SqlCommand cmd, SqlConnection conn, SqlTransaction trans, string cmdText, SqlParameter[] cmdParms)
        {
            if (conn.State != ConnectionState.Open)
                conn.Open();
            cmd.Connection = conn;
            cmd.CommandText = cmdText;
            if (trans != null)
                cmd.Transaction = trans;
            cmd.CommandType = CommandType.Text;//cmdType;
            if (cmdParms != null)
            {
                foreach (SqlParameter parameter in cmdParms)
                {
                    if ((parameter.Direction == ParameterDirection.InputOutput || parameter.Direction == ParameterDirection.Input) &&
                        (parameter.Value == null))
                    {
                        parameter.Value = DBNull.Value;
                    }
                    cmd.Parameters.Add(parameter);
                }
            }
        }

    }
}

相關(guān)文章

最新評(píng)論

金平| 上虞市| 黄大仙区| 宁南县| 武邑县| 内黄县| 大竹县| 保亭| 罗源县| 泽库县| 鹿泉市| 霍州市| 临清市| 新余市| 百色市| 兰考县| 洞口县| 虎林市| 元江| 安宁市| 文登市| 盘山县| 奇台县| 蒙山县| 郓城县| 建德市| 淄博市| 绩溪县| 东海县| 德令哈市| 达孜县| 六安市| 分宜县| 灵台县| 云龙县| 崇州市| 承德市| 封开县| 阿巴嘎旗| 眉山市| 大化|