使用參數化更新命令更新多個mysql列

Question

在我的應用程序中，我想使用UPDATE命令來更新多個MySQL列。我用下面的代碼嘗試了它，但我知道它確實不安全。因爲它導致了SQL注入攻擊。但我不知道如何編寫帶有參數的查詢來更新多個MySQL列。

這是我的代碼：

string constring = string.Format("datasource='{0}';port='{1}';database='{2}';username=claimsprologin;password=xxxxxxxxxxxxxxxx;Connect Timeout=180;Command Timeout=180", serveriplable.Text, portno.Text, databasenamelable.Text); 
string Query = "update claimloans set loannumber= '" + this.loannumbertextbox.Text.Trim() + " ', pool = '" + this.loanpooltextbox.Text.Trim() + "' , disblid = '" + this.disbidtextbox.Text.Trim() + "' , category = '" + this.categorytxtbox.Text.Trim() + " ', subcacategory = '" + this.subcategorytxtbox.Text.Trim() + " ', invoice = '" + this.invoicenumbertextbox.Text.Trim() + " ', invoicedate = '" + this.invoicedatetextbox.Text.Trim() + " ', docs = '" + this.docscombobox.Text.Trim() + "' , where username = '" + this.usernamelable.Text.Trim() + "' ;"; 
MySqlConnection conwaqDatabase = new MySqlConnection(constring); 
MySqlCommand cmdwaqDatabase = new MySqlCommand(Query, conwaqDatabase); 
MySqlDataReader myreader; 

try { 
    conwaqDatabase.Open(); 
    myreader = cmdwaqDatabase.ExecuteReader(); 
    while (myreader.Read()) { } 

    MessageBox.Show("Credential informations are updated"); 

    conwaqDatabase.Close(); 
} 

catch { 

} 

Answer 1

您可以使用這樣的事情。您在您的sql命令中添加佔位符，然後在運行ExecuteReader之後添加參數值。

string constring = string.Format("datasource='{0}';port='{1}';database='{2}';username=claimsprologin;password=gfx)C#G$aD3bL`@;Connect Timeout=180;Command Timeout=180", serveriplable.Text, portno.Text, databasenamelable.Text); 
string Query = "update claimloans set loannumber= @loannumbertextbox, pool = @loanpooltextbox, disblid = @disbidtextbox, category = @categorytxtbox, subcacategory = @subcategorytxtbox, invoice = @invoicenumbertextbox, invoicedate = @invoicedatetextbox, docs = @docscombobox, where username = @usernamelable;"; 
MySqlConnection conwaqDatabase = new MySqlConnection(constring); 
MySqlCommand cmdwaqDatabase = new MySqlCommand(Query, conwaqDatabase); 

cmdwaqDatabase .Parameters.AddWithValue("@loannumbertextbox", this.loannumbertextbox.Text.Trim());