C# 防止SQL注入攻击
http://blog.csdn.net/limlimlim/article/details/8629582
l登录判断：select * from T_Users where UserName=... and Password=...，将参数拼到SQL语句中。
l构造恶意的Password：hello‘ or 1=1 --
l if (dataReader.Read())
l {
l MessageBox.Show("登陆成功");
l }
l else
l {
l MessageBox.Show("登陆失败");
l }
l防范注入漏洞攻击的方法：不使用SQL语句拼接，通过参数赋值
string constr = "Data Source=zxtiger;Initial Catalog=itcastcn;Integrated Security=True";
using (SqlConnection
con = new SqlConnection(constr))
{
string sql
= "select count(*) from UserLogin where [email protected] and [email protected]";
using
(SqlCommand cmd = new SqlCommand(sql, con))
{
////在执行之前告诉Command对象@uid与@pwd将来用谁来代替
////为变量@uid与@pwd赋值
//cmd.Parameters.AddWithValue("@uid",
txtUid.Text.Trim());
//cmd.Parameters.AddWithValue("@pwd", txtPwd.Text);
#region MyRegion
//SqlParameter p1 = new
SqlParameter("@uid", txtUid.Text.Trim());
//cmd.Parameters.Add(p1);
//SqlParameter p2 = new SqlParameter("@pwd",
txtPwd.Text);
//cmd.Parameters.Add(p2);
#endregion
SqlParameter[] pms = new
SqlParameter[] {
new SqlParameter("@uid",
txtUid.Text.Trim()),
new SqlParameter("@pwd",
txtPwd.Text)
};
cmd.Parameters.AddRange(pms);
con.Open();
int r =
Convert.ToInt32(cmd.ExecuteScalar());
con.Close();
if (r > 0)
{
MessageBox.Show("登录成功！");
}
else
{
MessageBox.Show("登录失败！");
}
}
}