C#中预处理防注入式攻击的方法:

[secretpp]

switch (operation)
{
case "=":
whereSql = string.Format(" and {0}=@{0} ", field);

break;
case "likeAll"://左右全匹配
whereSql = string.Format(" and {0} like '%'+@{0}+'%' ", field);
break;
case "likeLeft"://左边匹配
whereSql = string.Format(" and {0} like @{0}+'%' ", field);
break;
case "likeRight"://右边匹配
whereSql = string.Format(" and {0} like '%'+@{0} ", field);
break;
case ">":
whereSql = string.Format(" and {0} > @{0} ", field);
break;
case "<":
whereSql = string.Format(" and {0} < @{0} ", field);
break;
default:
whereSql = string.Format(" and {0} {1} @{0} ", field, operation);
break;
}







完整的方法: /// <summary>
/// 返回查询条件 如果为null或null则跟它无关,否则返回and 字段=字段值 注意,它只是 and 的查询条件,没有where 左右都已留有空格
/// </summary>
/// <param name="field">传入 字段 的名称</param>
/// <param name="fieldValue">传入 字段 的值</param>
/// <param name="operation">传入 条件符号 如= < > like likeAll likeLeft likeRight 的值</param>
/// <param name="defaultValue">传入 如果为空则是0 或者其它默认值 的值</param>
/// <param name="sqlParameter">传入 参数 的值</param>
/// <param name="sqlDbType">传入 参数类型 的值</param>
/// <param name="len">传入 参数长度 的值</param>
/// <returns>如果传入的查询条件是空值或trim后是空值，则跟本查询条件无关，返回空</returns>
public static string getAndWhere(string field, string fieldValue, string operation, string defaultValue,out SqlParameter sqlParameter, SqlDbType sqlDbType, int len)
{
sqlParameter = null;
if (string.IsNullOrEmpty(fieldValue))
{
if (string.IsNullOrEmpty(defaultValue))
{
return defaultValue;
}
else
{
fieldValue = defaultValue;
}
}
else if (string.IsNullOrEmpty(fieldValue.Trim()))
{
if (string.IsNullOrEmpty(defaultValue))
{
return defaultValue;
}
else
{
fieldValue = defaultValue;
}
}
// Utility_.antivirus("d");
string whereSql = "";
switch (operation)
{
case "=":
whereSql = string.Format(" and {0}=@{0} ", field);

break;
case "likeAll"://左右全匹配
whereSql = string.Format(" and {0} like '%'+@{0}+'%' ", field);
break;
case "likeLeft"://左边匹配
whereSql = string.Format(" and {0} like @{0}+'%' ", field);
break;
case "likeRight"://右边匹配
whereSql = string.Format(" and {0} like '%'+@{0} ", field);
break;
case ">":
whereSql = string.Format(" and {0} > @{0} ", field);
break;
case "<":
whereSql = string.Format(" and {0} < @{0} ", field);
break;
default:
whereSql = string.Format(" and {0} {1} @{0} ", field, operation);
break;
}
sqlParameter = new SqlParameter("@" + field, sqlDbType, len);
sqlParameter.Value = fieldValue;
return whereSql;
}

[threenewbee]

用SqlParameter参数化SQL。

[小猪八Q]

字符串拼接，很容易出问题，要不使用SqlParameter，要不就做字符串预处理，剔除不符合规则的关键字，推荐使用前者

[以专业开发人员为伍]

“预处理”是什么东西？奇怪。

[bigbaldy]

参数化即可，不用这么麻烦，或者直接用ORM

[PaulyJiang]

参数化就行了