分类：电脑/网络-程序设计
问题：防止sql注入如何在.net开发过程中防止SQL注入 
如何在.net过程中防止SQL注入
回答：用参数化查询给你参考一下！     OleDbommand   insertCom=new   OleDbCommand();     insertCom.CommandText="insert   into   insurance(name,specify,yearnumber,typeworkid,sumorwin)   values(?,?,?,?,?)   ";     insertCom.Parameters.Add(new   OleDbParameter("@name",OleDbType.VarChar,100,"name"));     insertCom.Parameters.Add(new   OleDbParameter("@specify",OleDbType.VarChar,100,"specify"));     insertCom.Parameters.Add(new   OleDbParameter("@yearnumber",OleDbType.Integer,100,"yearnumber"));     insertCom.Parameters.Add(new   OleDbParameter("@typeworkid",OleDbType.VarChar,50,"typeworkid"));     insertCom.Parameters.Add(new   OleDbParameter("@sumorwin",OleDbType.VarChar,10,"sumorwin"));     insertCom.Parameters[0].Value=txtBox1.Text.Trim();     insertCom.Parameters[1].Value=txtBox2.Text.Trim();     insertCom.Parameters[2].Value=int.Parse(txtBox3.Text.Trim());     insertCom.Parameters[3].Value=typeworkid;     insertCom.Parameters[4].Value=cmBox2.Text;                                                 insertCom.Connection=oleCon;     if(oleCon.State==System.Data.ConnectionState.Closed)     {     oleCon.Open();     }     insertCom.ExecuteNonQuery();