C#sql语句规范

样式一（对于传入参数的场景，防止sql攻击）：

using CodeReading.Entity;
using CodeReading.Entity.Comm;
using CodeReading.Entity.History;
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Data.SqlClient;
using System.Linq;
using System.Text;namespace CodeReading.View.DAL
{
    public class HistoryDAL
    {
        // 数据取得
        private static string connectionString = ConfigurationManager.ConnectionStrings["ConnectionStrings"].ConnectionString;

    
        public SearchResult Search(SearchConditions searchConditions)
        {
            using (var conn = new SqlConnection(connectionString))
            using (var cmd = new SqlCommand())
            {
                cmd.Connection = conn;

                // SQL参数生成
                StringBuilder sql = new StringBuilder();
                // SELECT DbId,OtherID,Signed,TagCode,ScanDate,Pass,FileName FROM dbo.Used
                sql.AppendLine(" SELECT ");
                sql.AppendLine("    ,DbId");                                                             // 表单类型
                sql.AppendLine("    ,FileName");                                                         // 图片名
                sql.AppendLine("  FROM   ");
                sql.AppendLine("      dbo.Used ");                                                       // Used表
                sql.AppendLine("  Where   ");
                sql.AppendLine("       ScanDate >= @hsDtpFrom ");                  // 扫描开始时刻
                sql.AppendLine("   And ScanDate <= @hsDtpTo ");                    // 扫描结束时刻
                cmd.Parameters.Add("@hsDtpFrom", searchConditions.HsDtpFrom);         // 扫描开始时刻 赋值
                cmd.Parameters.Add("@hsDtpTo", searchConditions.HsDtpTo);             // 扫描结束时刻 赋值
                // "表单类型"有值时
                if (!string.IsNullOrEmpty(searchConditions.HsDbId))
                {
                    sql.AppendLine("   And  DbId = @hsDbId ");                      // 表单类型
                    cmd.Parameters.Add("@hsDbId", searchConditions.HsDbId);           // 表单类型 赋值
                }// 数据取得
                cmd.CommandText = sql.ToString();
                using (SqlDataAdapter reader = new SqlDataAdapter(cmd))
                {
                    var result = new SearchResult();
                    result.Suceeded = true;
                    var errorInfo = new ErrorInfo();
                    result.ErrorInfo = errorInfo;

                    var dt = new HistoryDataSet.SearchListDataTable();
                    reader.Fill(dt);
                    result.SearchData = dt;
                    reusing CodeReading.Entity;

             return result;

....

 规范二（适合安全可控的程序的接口）：

using System;

public class Class1
{
    public void CV()
    {
        StringBuilder sUMresult = new StringBuilder();

        using (SqlConnection conn = new SqlConnection(Appconfig.GetMSStr()))
        {
            conn.Open();
            using (SqlTransaction trans = conn.BeginTransaction())
            {
                try
                {
                    SqlCommand cmd = new SqlCommand();
                    cmd.Connection = conn;
                    cmd.Transaction = trans;

                    StringBuilder resultlog = new StringBuilder();
                    string chksql = "";

                    // sql1
                    chksql = @"delete from table where Work='{1}'";
                    chksql += @" and LotNO in (select * from table where id='{0}')";
                    chksql = string.Format(chksql, idstr, workstr);
                    resultlog.AppendLine(" sql:" + chksql);
                    cmd.CommandText = chksql;
                    cmd.ExecuteNonQuery();

                    //sql2略

                    trans.Commit();

                    resultlog.AppendLine("删除执行完毕");
                    Appconfig.WriteLogFile(resultlog.ToString(), "删除日志");

                    result.Code = 0;
                    result.ResMsg = "删除成功";
                    result.IsSuccess = true;
                    #region
                    #endregion
                }
                catch (Exception ex)
                {
                    trans.Rollback();

                    result.Code = -1;
                    result.ResMsg = ex.Message;
                    sUMresult.AppendLine("ID:" + idstr + "+Work:" + workstr + ",删除出错" + ex.Message);
                    result.IsSuccess = false;

                    StringBuilder str = new StringBuilder();
                    str.AppendLine("ID:" + idstr);
                    str.AppendLine("Work:" + workstr);
                    str.AppendLine("删除出错:" + ex.Message);
                    Appconfig.WriteLogFile(str.ToString(), "删除日志");
                }
            }
            conn.Close();
        }
    }
}