不用存储过程实现传参防注入的方法

 public static bool Addwebinfo(string Username ,string Password, string Webname,string Weburl, string Webintr)
    {
            int isUpdateOk = 0;
            string Strsql = "insert into xy_user(username,password,webname,weburl,webintr)values(@username,@password,@webname,@weburl,@webintr)";
            SqlConnection Conn = DBFun.OpenConn();
            SqlCommand Cmd = DBFun.Sqlcmd(Strsql, Conn);
            Cmd.Parameters.Add("@username", SqlDbType.VarChar);
            Cmd.Parameters.Add("@password", SqlDbType.VarChar);
            Cmd.Parameters.Add("@webname", SqlDbType.VarChar);
            Cmd.Parameters.Add("@weburl", SqlDbType.VarChar);
            Cmd.Parameters.Add("@webintr", SqlDbType.VarChar);
            Cmd.Parameters["@username"].Value = Username;
            Cmd.Parameters["@password"].Value = Password;
            Cmd.Parameters["@webname"].Value = Webname;
            Cmd.Parameters["@weburl"].Value = Weburl;
            Cmd.Parameters["@webintr"].Value = Webintr;
        try
        {
        
            Conn.Open();
            isUpdateOk = Convert.ToInt32(Cmd.ExecuteNonQuery());;
            DBFun.CloseConnection(Conn);
            return true;
        }
        catch (Exception e)
        {
            throw new Exception(e.Message);
        }
        finally
        {
            DBFun.CloseConnection(Conn);
            Cmd.Dispose();
         
        }
        if (isUpdateOk > 0)
        {
            return true;
        }
        else
        {
            return false;
        }