SQL注入理解麻烦c＃

作者: 無口君
发布时间: 2024-12-22 09:04:21 (1月前)
转自：

2 条回复

0#
回复此人
那年 | 2019-08-31 10-32

<div class =“post-text”itemprop =“text”> <P> 试试这个样本，请相应地进行编辑以满足您的需求。 </p> <pre> <code> using System.Data; using MySql.Data.MySqlClient; var timeIn = blabla; var eID = lblEID.Text; //var blablabla = blablabla; var query = @"UPDATE mia_payroll.tbl_attendance SET TimeIn = @TimeIn, Date = @Date, EID = @EID"; //are you missing a WHERE clause? otherwise you will update all row. maybe you want to do something like below. //var query = @"UPDATE mia_payroll.tbl_attendance SET TimeIn = @TimeIn, Date = @Date, EID = @EID WHERE rowID = @rowID"; using(MySqlConnection myConn = new MySqlConnection(ConnectionClass.GetConnection())) using(MySqlCommand cmDB = new MySqlCommand(query, myConn)) { try { //for your question to me about adding parameters value, just keep adding. cmDB.Parameters.AddWithValue("@TimeIn", timeIn); cmDB.Parameters.AddWithValue("@eID", eID); //cmDb.Parameters....... and so on //now execute query myConn.Open(); using(MySqlDataReader myReader = cmDB.ExecuteReader()) { while(myReader.Read()) { //do what you want with your result. } } } catch (Exception ex) { MessageBox.Show(ex.Message); } finally { myConn.Close(); } } </code> </pre> </DIV>

编辑

登录后才能参与评论