SQL学习笔记[1] - 防注入攻击：一个参数传值+模糊查询的参考写法

OracleConnection conn = new OracleConnection(ConfigurationManager.ConnectionStrings["ConnStr_Ora"].ConnectionString);

conn.Open();

OracleCommand cmd = new OracleCommand("select VENDOR_REF,NAME,SHORT_NAME,SITE,ADDRESS,COMMENTS,S_CONTACT,POST_OR_ZIP,TELEPHONE,FAX,CAUTION_TEXT FROM SCP" + schema_proj + ".VDB_VENDORS WHERE NAME LIKE :vendor AND COMMENTS LIKE :specialty AND CAUTION_TEXT
LIKE :isQualified ORDER BY VENDOR_REF", conn);
cmd.Parameters.Add(new OracleParameter("vendor", OracleType.VarChar, 60));

cmd.Parameters["vendor"].Value = "%" + vendor_name + "%";

cmd.Parameters.Add(new OracleParameter("specialty", OracleType.VarChar, 20));

cmd.Parameters["specialty"].Value = "%" + dll_specialty.SelectedValue + "%";

cmd.Parameters.Add(new OracleParameter("isQualified", OracleType.VarChar, 20));

cmd.Parameters["isQualified"].Value = "%" + dll_isQulified.SelectedValue + "%";
OracleDataAdapter sad = new OracleDataAdapter(cmd);

DataSet ds = new DataSet();

sad.Fill(ds);

gv.DataSource = ds;

gv.DataBind();

conn.Close();