SQL 注入 参数化
StringBuilder sbSelect = new StringBuilder();
System.Data.OracleClient.OracleParameter[] parms = { };
ArrayList listParms = new ArrayList();
string sqlgetobject = "select t.* from table t where t.id= :ID ";
listParms.Add(new System.Data.OracleClient.OracleParameter(":ID ", this.ID));
parms = (System.Data.OracleClient.OracleParameter[])listParms.ToArray(typeof(System.Data.OracleClient.OracleParameter));
DataTable dteval = bll.GetbySql(sqlgetobject, parms);
相关推荐
qshpeng 2020-03-06
ALiDan 2020-07-27
qshpeng 2020-07-26
世樹 2020-07-17
chenjiazhu 2020-07-08
一对儿程序猿 2020-07-04
明月清风精进不止 2020-06-13
godfather 2020-06-13
ItBJLan 2020-06-11
tanrong 2020-06-11
ALiDan 2020-06-11
码墨 2020-06-09
世樹 2020-06-05
lt云飞扬gt 2020-06-03
godfather 2020-06-03
qshpeng 2020-05-11
明月清风精进不止 2020-05-07