ADO.NET基础学习-----四种模型,防止SQL注入

1.ExcuteNonQuery

　　执行非查询语句，返回受影响的行数。

           // 1.ExcuteNonQuery

            string sqlconn = "Data Source=wss;Initial Catalog=TextDB;User ID=sa;Password=w778764;Integrated Security=true";
            SqlConnection conn = new SqlConnection(sqlconn);
            conn.Open();
            SqlCommand cmd = new SqlCommand();
            cmd.Connection = conn;
            cmd.CommandText = "insert into TB_USER(userID,password,LastTime,code) values ('fungame','131313',2005-05-23,56)";
            int num = cmd.ExecuteNonQuery();
            conn.Close();
            conn.Dispose();
            Console.Write("(共有{0}行受影响",num.ToString());
            Console.ReadKey();

---

2.ExcuteScalar

　　执行查询语句，返回一行一列的数据。

            2.ExcuteScaler
            string sqlconn= "data source = wss;uid = sa;pwd = w778764;Integrated Security = true;Initial Catalog = TextDB;";
            string sql = "select * from TB_USER ";
            using (SqlConnection conn = new SqlConnection (sqlconn))
            {
                using (SqlCommand cmd = new SqlCommand(sql,conn))
                {
                    conn.Open();
                    string str = cmd.ExecuteScalar().ToString();
                    Console.WriteLine(str);
                    conn.Close();
                }
            }
            Console.ReadKey();

---

3.参数化查询（防止SQL注入<1' or '1' = '1>）

            //3.防止SQL注入，参数化查询
            Console.WriteLine("请输入用户名：");
            string uid =Console.ReadLine();
            Console.WriteLine("请输入密码");
            string pwd = Console.ReadLine();

            string sqlconn = "data source = wss;uid = @uid;pwd = @pwd;Integrated Security = true;Initial Catalog = TextDB;";
            string sqldtr = "select count(*) from TB_USER;";

            SqlParameter spuid = new SqlParameter(@uid, uid);//构建参数化对象
            SqlParameter sppwd = new SqlParameter(@pwd, pwd);

            using (SqlConnection conn = new SqlConnection(sqlconn))
            {
                using (SqlCommand cmd = new SqlCommand(sqldtr,conn))
                {
                    
                    cmd.Parameters.Add(spuid);//将参数对象添加入执行列表
                    cmd.Parameters.Add(sppwd);
                    conn.Open();
                    int num =(int) cmd.ExecuteScalar();
                    conn.Close();
                    Console.Write("n={0}", num);
                }
            }

---

4.sqldatareader

　　执行查询语句，将数据暂存到sqldatareader对象中，可以通过索引将数据逐行取出。

            4.sqldatareader使用
            string sqlstr = "data source = wss;uid =@uid;pwd =@pwd;Initial Catalog = TextDB;Integrated Security = true;";
            string sql = "select * from TB_USER;";
            string uid = "12";
            string pwd = "123";
            SqlParameter suid = new SqlParameter(@uid, uid);
            SqlParameter spwd = new SqlParameter(@pwd, pwd);
            using (SqlConnection conn = new SqlConnection (sqlstr))
            {
                using (SqlCommand cmd = new SqlCommand(sql, conn))
                {
                    cmd.Parameters.Add(suid);
                    cmd.Parameters.Add(spwd);
                    conn.Open();
                    SqlDataReader sqlread = cmd.ExecuteReader();
                    using (sqlread)
                    {
                        while(sqlread.Read())
                        {
                            for (int i = 0; i < sqlread.FieldCount; i++)
                            {
                                string data = sqlread[i].ToString();
                                Console.Write(data+"	");
                            }
                            Console.WriteLine();
                        }
                    }
                    conn.Close();
                }
            }

---

5.SqlDataAdapter

　　通过 DataAdapter 使用数据源中的数据生成和填充 DataSet 中的每个 DataTable，可以通过索引将单个的datatable数据绑定到数据容器中显示，如：datagridview。

　　该实例中是建立了winform程序，设计视图中添加一个gridview和按钮控件，在按钮单击事件中添加如下代码。tips:girdview属性中的Anchor（锚；抛锚停泊）可以设定控件的四个方向是否跟随窗口大小改动而改动。

private void button1_Click(object sender, EventArgs e)
        {
            string sqlstr = "data source = wss;uid =@uid;pwd =@pwd;Initial Catalog = TextDB;Integrated Security = true;";
            string sql = "select * from TB_USER;";
            DataSet ds = new DataSet();
            using (SqlDataAdapter sda = new SqlDataAdapter(sql,sqlstr))
            {
                sda.Fill(ds);
            }
            dataGridView1.DataSource = ds.Tables[0];
        }

 如果这些内容帮助到你了，希望您给予支持 o(^▽^)o （支付宝）

（支付宝）