防止SQL注入的方法

//方法一：参数化查询。缺点：增大数据库的压力
string ConnectionString="";//数据库连接字串
string CustomerID = string.Empty;
string CompanyName =string.Empty;
string Address =string.Empty;
using (SqlConnection cn = new SqlConnection(ConnectionString))
{
cn.Open();
SqlCommand cmd = new SqlCommand("insert into Customers(CustomerID,CompanyName,Address) values(@CustomerID,@CompanyName,@Address)", cn);
//cmd.Parameters.Add(new SqlParameter("@CustomerID", CustomerID)); 不会去与数据库匹配
cmd.Parameters.Add("@CustomerID", SqlDbType.NChar, 5, CustomerID);//这种设置的数据类型，长度都必须与数据库字段一致
cmd.Parameters.Add("@CompanyName", SqlDbType.NVarChar, 40, CompanyName);
cmd.Parameters.Add("@Address", SqlDbType.NVarChar, 60, Address);
cmd.ExecuteNonQuery();
cn.Close();
}

//方法二：过滤输入的信息，检查是否存在危险字符。不必连接数据库
/// <summary>
/// 检查输入的数据 是否存在危险字符
/// </summary>
/// <param name="sUser"></param>
/// <param name="sPwd"></param>
/// <returns>返回一个bool值</returns>
public bool CheckData(string sUser, string sPwd)
{
if (sUser.IndexOf("'") != -1 || sPwd.IndexOf("%") != -1)
{
return false;
}
return true;
}
//方法三：使用存储过程（简单代码）
string ConnectionString = "";//数据库连接字串
string CustomerID = string.Empty;
string CompanyName = string.Empty;
string Address = string.Empty;
using (SqlConnection cn = new SqlConnection(ConnectionString))
{
cn.Open();
string Sql = "InsertUserProc";//存储过程名
SqlCommand cmd = new SqlCommand(Sql,cn);
cmd.CommandType = CommandType.StoredProcedure;

cmd.ExecuteNonQuery();
cn.Close();
}