防止sql注入 參數化解決方案

StringBuilder strSql=new StringBuilder(); strSql.Append("insert into T_SysLog("); strSql.Append("UserID,UserName,LogContent,CreateTime"); strSql.Append(") values ("); strSql.Append("@UserID,@UserName,@LogContent,@CreateTime"); strSql.Append(") "); strSql.Append(";select @@IDENTITY");SqlParameter[] parameters = { new SqlParameter("@UserID", SqlDbType.NVarChar,20) , new SqlParameter("@UserName", SqlDbType.NVarChar,50) , new SqlParameter("@LogContent", SqlDbType.Text) , new SqlParameter("@CreateTime", SqlDbType.DateTime) }; parameters[0].Value = model.UserID; parameters[1].Value = model.UserName; parameters[2].Value = model.LogContent; parameters[3].Value = model.CreateTime;