SqlParameter 用法总结

作用

解决恶意的T-sql语句攻击第一种

 //传入参数  string ProductGroupCode, string Ismaintain, int HierarchyID, string BOMName,string BOMCode, string BOMType, int BOPStepType, int PageIndex, int PageSize, out int TotalCount

public static DataTable GetBOPStepByBOM(string ProductGroupCode, string Ismaintain, int HierarchyID, string BOMName,string BOMCode, string BOMType, int BOPStepType, int PageIndex, int PageSize, out int TotalCount)
        {
            SqlParameter[] parameters = {
                    new SqlParameter("@ProductGroupCode", SqlDbType.VarChar),  //自定义参数  与参数类型    
                    new SqlParameter("@Ismaintain", SqlDbType.VarChar),
                    new SqlParameter("@HierarchyID", SqlDbType.Int),
                    new SqlParameter("@BOMName", SqlDbType.VarChar),
                    new SqlParameter("@BOMType", SqlDbType.VarChar),
                    new SqlParameter("@BOPStepType", SqlDbType.Int),
                    new SqlParameter("@PageIndex", SqlDbType.Int),
                    new SqlParameter("@PageSize", SqlDbType.Int),
                    new SqlParameter("@TotalCount", SqlDbType.Int),
                    new SqlParameter("@BOMCode", SqlDbType.VarChar),
            };

            parameters[0].Value = ProductGroupCode;  //给参数赋值
            parameters[1].Value = Ismaintain;
            parameters[2].Value = HierarchyID;
            parameters[3].Value = BOMName;
            parameters[4].Value = BOMType;
            parameters[5].Value = BOPStepType;
            parameters[6].Value = PageIndex;
            parameters[7].Value = PageSize;
            parameters[8].Direction = ParameterDirection.Output;
            parameters[9].Value = BOMCode;

            SqlDataAccess sqlDataAccess = SqlDataAccess.CreateDataAccess();  //自定义帮助类   主要作用  开始   执行  关闭  ADO.net 
            DataSet result = sqlDataAccess.ExecuteDataSet("up_BasicInfo_GetBOPStepListByBOM", parameters);  //这里执行的是存储过程   并接收返回值
            TotalCount = parameters[8].Value == DBNull.Value ? default(int) : (int)parameters[8].Value;
            return result.Tables[0];   //最终返回执行结果
        }

第二种

   public static int InsertOrderCause(string productGroupCode, int customerBelongTo, int salesTypeID,
            string orderCauseList)
        {
            int ret = 0;

            SqlParameter[] paras =
            {
                new SqlParameter("@ProductGroupCode",productGroupCode),  //不声明变量类型 直接进行复制
                new SqlParameter("@CustomerBelongTo",customerBelongTo),
                new SqlParameter("@SalesTypeID",salesTypeID),
                new SqlParameter("@OrderCauseList",orderCauseList)
            };

            SqlDataAccess sqlDataAccess = SqlDataAccess.CreateDataAccess();
            ret = sqlDataAccess.ExecuteNonQuery("up_BasicInfo_InsertOrderCause", paras);

            return ret;
        }