字符串前加@是里面特殊符号不用转义了。
像UPDATE User set uname=@uname,upass=@upass.可以这样写
SqlConnection con = new SqlConnection("数据库连接串");
string sql = "UPDATE User set uname=@uname,upass=@upass";
SqlCommand cmd = new SqlCommand();
cmd.Parameters.AddWithValue("@uname", "helloworld");
cmd.Parameters.AddWithValue("@upass", "helloworld");
con.Open();
cmd.ExecuteNonQuery();
con.Close();