如何使用SQL参数从SQL Server获取数据集
技术问答
108 人阅读
|
0 人回复
|
2023-09-14
|
|
我正在从事C＃项目，不熟悉这项技术。, i! b# Z9 ~/ J0 s1 a [
我想从SQL Server 在2008年读取一些数据，并编写以下代码
$ g5 A7 u3 u! W! L ^2 Dcon); User user = new User()； DataRow dr; try da.Fill(ds); dr = ds.Tables[0].Rows[0]user.Id = Convert.ToInt16(dr["userID"]); user.FirstName = (string)dr["firstName"]; user.LastName = (string)dr["lastName"]; user.Email = (string)dr["email"]; user.Username = (string)dr["userName"]; user.Password = (string)dr["password"]; user.type = (string)dr["type"]; return user; } catch (Exception ex) return null; end of select methodcon); User user = new User(); DataRow dr; try { da.Fill(ds); dr = ds.Tables[0].Rows[0]; user.Id = Convert.ToInt16(dr["userID"]); user.FirstName = (string)dr["firstName"]; user.LastName = (string)dr["lastName"]; user.Email = (string)dr["email"]; user.Username = (string)dr["userName"]; user.Password = (string)dr["password"]; user.type = (string)dr["type"]; return user; } catch (Exception ex) { return null; }}//end of select method但是我读过一篇文章SQL注入文章，我想用SQL为了避免这种情况，我不知道该怎么办。# v" s" V& K, c, ]% P" x; Q
( L" y$ s! X0 M1 M% h* _) e- W! V 解决方案: 6 l5 m) Y6 k+ }+ ?/ u
这是对代码的简单重做。未经测试，但本质上包括在一次性对象周围添加using使用参数集合的语句和语句SqlCommand W. F$ o% Y5 N$ w
password); using(SqlDataAdapter da = new SqlDataAdapter(cmd)) User user = new User()；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；；DataRow dr; da.Fill(ds); dr = ds.Tables[0].Rows[0]user.Id = Convert.ToInt16(dr["userID"]); user.FirstName = (string)dr["firstName"]; user.LastName = (string)dr["lastName"]; user.Email = (string)dr["email"]; user.Username = (string)dr["userName"]; user.Password = (string)dr["password"]; user.type = (string)dr["type"]; return user; password); using(SqlDataAdapter da = new SqlDataAdapter(cmd)) { User user = new User(); DataRow dr; da.Fill(ds); dr = ds.Tables[0].Rows[0]; user.Id = Convert.ToInt16(dr["userID"]); user.FirstName = (string)dr["firstName"]; user.LastName = (string)dr["lastName"]; user.Email = (string)dr["email"]; user.Username = (string)dr["userName"]; user.Password = (string)dr["password"]; user.type = (string)dr["type"]; return user; }}注意命令文本如何不直接包含用户和密码符串，而是一个简单的参数占位符(@uname and@pwd)。添加参数SqlCommand这些占位符称为参数名称。
; t* a2 y) G$ G在查看检索到的数据的用途时，我强烈建议您查看简单的数据ORM工具（例如Dapper），该工具可直接转换User对象中所有这些代码 |
|
|
|
|
|
|
|
|
|
