简单高效防注入攻击的动态多参数、动态SQL语句拼接方法，提高网站的安全性

        #region public DataTable Search(string folderId, string searchValue, Boolean deleteMark) 查询
        /// <summary>
        /// 查询
        /// </summary>
        /// <param name=”folderId”>目录</param>
        /// <param name=”searchValue”>查询条件</param>
        /// <param name=”deleteMark”>删除标志</param>
        /// <returns>数据表</returns>
        public DataTable Search(string folderId, string searchValue, Boolean deleteMark)
        {
            // 一、这里是将Boolean值转换为int类型。
            int delete = deleteMark ? 1: 0;

            // 二、这里是开始进行动态SQL语句拼接，字段名、表明都进行了常量定义，表名字段名发生变化时，很容易就知道程序哪里都调用了这些。
            string sqlQuery = string.Empty;
            sqlQuery = “ SELECT “ + BaseNewsTable.FieldId
                    + “        ,“ + BaseNewsTable.FieldFolderId
                    + “        ,“ + BaseNewsTable.FieldTitle
                    + “        ,“ + BaseNewsTable.FieldFilePath
                    + “        ,“ + BaseNewsTable.FieldFileSize
                    + “        ,“ + BaseNewsTable.FieldReadCount
                    + “        ,“ + BaseNewsTable.FieldDescription
                    + “        ,“ + BaseNewsTable.FieldCategoryCode
                    + “        ,“ + BaseNewsTable.FieldEnabled
                    + “        ,“ + BaseNewsTable.FieldDeleteMark
                    + “        ,“ + BaseNewsTable.FieldSortCode
                    + “        ,“ + BaseNewsTable.FieldCreateUserId
                    + “        ,“ + BaseNewsTable.FieldCreateUserRealname
                    + “        ,“ + BaseNewsTable.FieldCreateDate
                    + “        ,“ + BaseNewsTable.FieldModifyUserId
                    + “        ,“ + BaseNewsTable.FieldModifyUserRealname
                    + “        ,“ + BaseNewsTable.FieldModifyDate
                    + “ FROM “ + this.CurrentTableName
                    + “ WHERE “ + BaseNewsTable.FieldDeleteMark + “ = “ + delete;

            // 三、我们认为 folderId 这个查询条件是安全，不是人为输入的参数，所以直接进行了SQL语句拼接
            if (!String.IsNullOrEmpty(folderId))
            {
                sqlQuery += “ AND “ + BaseNewsTable.FieldFolderId + “ = ‘“ + folderId + “‘“;
            }

// 四、这里是进行参数化的准备，因为是多个不确定的查询参数，所以用了List。
List<DbParameter> dbParameters = new List<DbParameter>();

            // 五、这里看查询条件是否为空
            searchValue = searchValue.Trim();
            if (!String.IsNullOrEmpty(searchValue))
            {
                // 六、这里是进行支持多种数据库的参数化查询
                sqlQuery += “ AND (“ + BaseNewsTable.FieldTitle + “ LIKE “ + DbHelper.GetParameter(BaseNewsTable.FieldTitle);
                sqlQuery += “ OR “ + BaseNewsTable.FieldCreateUserRealname + “ LIKE “ + DbHelper.GetParameter(BaseNewsTable.FieldCreateUserRealname);
                sqlQuery += “ OR “ + BaseNewsTable.FieldContents + “ LIKE “ + DbHelper.GetParameter(BaseNewsTable.FieldContents);
                sqlQuery += “ OR “ + BaseNewsTable.FieldDescription + “ LIKE “ + DbHelper.GetParameter(BaseNewsTable.FieldDescription) + “)“;

                // 七、这里是判断，用户是否已经输入了%
                if (searchValue.IndexOf(“%“) < 0)
                {
                    searchValue = “%“ + searchValue + “%“;
                }

                // 八、这里生成支持多数据库的参数
                dbParameters.Add(DbHelper.MakeInParam(BaseNewsTable.FieldTitle, searchValue));
                dbParameters.Add(DbHelper.MakeInParam(BaseNewsTable.FieldCreateUserRealname, searchValue));
                dbParameters.Add(DbHelper.MakeInParam(BaseNewsTable.FieldContents, searchValue));
                dbParameters.Add(DbHelper.MakeInParam(BaseNewsTable.FieldDescription, searchValue));
            }

            // 九、这里是将List转换为数组，进行数据库查询
            return DbHelper.Fill(sqlQuery, dbParameters.ToArray());
        }
        #endregion

原文链接：https://www.cnblogs.com/jirigala/archive/2010/07/28/1787291.html

原创文章，作者：优速盾-小U，如若转载，请注明出处：https://www.cdnb.net/bbs/archives/17216