c#中使用sql防注入方式写入数据

try

{

if (this.textBoxTransparent2_3.Text == null || this.textBoxTransparent2_3.Text == "")

{

MessageBox.Show("MIS项目编号是必填项!"); this.textBoxTransparent2_3.Focus(); return;

}

else if (textBoxTransparent_path.Text == "" || textBoxTransparent_path.Text == null)

{

MessageBox.Show("选择将要写入数据的SW工程图!"); this.textBoxTransparent_path.Focus(); return;

}

else

{

#region 写入工程图

tableEight();

tableNine();

tableTen();

MessageBox.Show("写入工程图成功");

#endregion

string table9_orderNo = this.textBoxTransparent2_3.Text;

DateTime dateTime = DateTime.Now;

string creater = global.account;

#region table8

string table8_1 = this.textBoxTransparent_1.Text;

string table8_2 = this.textBoxTransparent_2.Text;

string table8_3 = this.textBoxTransparent_3.Text;

string table8_4 = this.textBoxTransparent_4.Text;

string table8_5 = this.textBoxTransparent_5.Text;

string table8_6 = this.textBoxTransparent_6.Text;

string table8_7 = this.textBoxTransparent_7.Text;

string table8_8 = this.textBoxTransparent_8.Text;

string table8_9 = this.textBoxTransparent_9.Text;

string table8_10 = this.textBoxTransparent_10.Text;

string table8_11 = this.textBoxTransparent_11.Text;

#endregion

#region table9

string table9_1 = this.textBoxTransparent2_1.Text;

string table9_2 = this.textBoxTransparent2_2.Text;

string table9_4 = this.textBoxTransparent2_4.Text;

string table9_5 = this.textBoxTransparent2_5.Text;

string table9_6 = this.textBoxTransparent2_6.Text;

string table9_7 = this.textBoxTransparent2_7.Text;

string table9_8 = this.textBoxTransparent2_8.Text;

string table9_9 = this.textBoxTransparent2_9.Text;

string table9_10 = this.textBoxTransparent2_10.Text;

string table9_11 = this.textBoxTransparent2_11.Text;

string table9_12 = this.textBoxTransparent2_12.Text;

string table9_13 = this.textBoxTransparent2_13.Text;

string table9_14 = this.textBoxTransparent2_14.Text;

string table9_15 = this.textBoxTransparent2_15.Text;

string table9_16 = this.textBoxTransparent2_16.Text;

string table9_17 = this.textBoxTransparent2_17.Text;

string table9_18 = this.textBoxTransparent2_18.Text;

string table9_19 = this.textBoxTransparent2_19.Text;

string table9_20 = this.textBoxTransparent2_20.Text;

string table9_21 = this.textBoxTransparent2_21.Text;

string table9_22 = this.textBoxTransparent2_22.Text;

string table9_23 = this.textBoxTransparent2_23.Text;

string table9_24 = this.textBoxTransparent2_24.Text;

string table9_25 = this.textBoxTransparent2_25.Text;

string table9_26 = this.textBoxTransparent2_26.Text;

#endregion

#region table10

string table10_1 = this.textBoxTransparent3_1.Text;

string table10_2 = this.textBoxTransparent3_2.Text;

string table10_3 = this.textBoxTransparent3_3.Text;

string table10_4 = this.textBoxTransparent3_4.Text;

string table10_5 = this.textBoxTransparent3_5.Text;

string table10_6 = this.textBoxTransparent3_6.Text;

string table10_7 = this.textBoxTransparent3_7.Text;

string table10_8 = this.textBoxTransparent3_8.Text;

string table10_9 = this.textBoxTransparent3_9.Text;

string table10_10 = this.textBoxTransparent3_10.Text;

string table10_11 = this.textBoxTransparent3_11.Text;

#endregion

// 调用ExecuteScalar方法的示例

string queryString = "select [table9_orderNo] FROM [dbo].[1swtabledata] where [table9_orderNo] = '" + table9_orderNo + "'"; // 这里是一个没有参数的SQL查询

object result = SqlhelperClass.sqlHelper.ExecuteScalar(queryString, CommandType.Text);

if (result == null) // 如果没有此序列号,则新增数据

{

//如果没有此唯一序列号,就插入新增

// 定义你的 SQL 插入语句

string insertSql = "insert into [dbo].[1swtabledata] ([table9_orderNo] ,[table8_1] ,[table8_2] ,[table8_3] ,[table8_4] ,[table8_5] ,[table8_6] ,[table8_7] ,[table8_8] ,[table8_9] ,[table8_10] ,[table8_11] ,[table9_1] ,[table9_2] ,[table9_4] ,[table9_5] ,[table9_6] ,[table9_7] ,[table9_8] ,[table9_9] ,[table9_10] ,[table9_11] ,[table9_12] ,[table9_13] ,[table9_14] ,[table9_15] ,[table9_16] ,[table9_17] ,[table9_18] ,[table9_19] ,[table9_20] ,[table9_21] ,[table9_22] ,[table9_23] ,[table9_24] ,[table9_25] ,[table9_26] ,[table10_1] ,[table10_2] ,[table10_3] ,[table10_4] ,[table10_5] ,[table10_6] ,[table10_7] ,[table10_8] ,[table10_9] ,[table10_10] ,[table10_11],[dateTime],[creater]) values (@table9_orderNo, @table8_1, @table8_2, @table8_3, @table8_4, @table8_5, @table8_6, @table8_7, @table8_8, @table8_9, @table8_10, @table8_11, @table9_1, @table9_2, @table9_4, @table9_5, @table9_6, @table9_7, @table9_8,@table9_9, @table9_10, @table9_11, @table9_12, @table9_13, @table9_14, @table9_15, @table9_16, @table9_17, @table9_18, @table9_19, @table9_20, @table9_21, @table9_22, @table9_23, @table9_24, @table9_25, @table9_26, @table10_1, @table10_2, @table10_3, @table10_4, @table10_5, @table10_6, @table10_7, @table10_8, @table10_9, @table10_10, @table10_11, @dateTime, @creater);";

//创建 SQL 参数数组

SqlParameter[] parameters2 = new SqlParameter[]

{

#region 防注入

new SqlParameter("@table9_orderNo", table9_orderNo),

new SqlParameter("@table8_1", table8_1),

new SqlParameter("@table8_2", table8_2),

new SqlParameter("@table8_3", table8_3),

new SqlParameter("@table8_4", table8_4),

new SqlParameter("@table8_5", table8_5),

new SqlParameter("@table8_6", table8_6),

new SqlParameter("@table8_7", table8_7),

new SqlParameter("@table8_8", table8_8),

new SqlParameter("@table8_9", table8_9),

new SqlParameter("@table8_10", table8_10),

new SqlParameter("@table8_11", table8_11),

new SqlParameter("@table9_1", table9_1),

new SqlParameter("@table9_2", table9_2),

new SqlParameter("@table9_4", table9_4),

new SqlParameter("@table9_5", table9_5),

new SqlParameter("@table9_6", table9_6),

new SqlParameter("@table9_7", table9_7),

new SqlParameter("@table9_8", table9_8),

new SqlParameter("@table9_9", table9_9),

new SqlParameter("@table9_10", table9_10),

new SqlParameter("@table9_11", table9_11),

new SqlParameter("@table9_12", table9_12),

new SqlParameter("@table9_13", table9_13),

new SqlParameter("@table9_14", table9_14),

new SqlParameter("@table9_15", table9_15),

new SqlParameter("@table9_16", table9_16),

new SqlParameter("@table9_17", table9_17),

new SqlParameter("@table9_18", table9_18),

new SqlParameter("@table9_19", table9_19),

new SqlParameter("@table9_20", table9_20),

new SqlParameter("@table9_21", table9_21),

new SqlParameter("@table9_22", table9_22),

new SqlParameter("@table9_23", table9_23),

new SqlParameter("@table9_24", table9_24),

new SqlParameter("@table9_25", table9_25),

new SqlParameter("@table9_26", table9_26),

new SqlParameter("@table10_1", table10_1),

new SqlParameter("@table10_2", table10_2),

new SqlParameter("@table10_3", table10_3),

new SqlParameter("@table10_4", table10_4),

new SqlParameter("@table10_5", table10_5),

new SqlParameter("@table10_6", table10_6),

new SqlParameter("@table10_7", table10_7),

new SqlParameter("@table10_8", table10_8),

new SqlParameter("@table10_9", table10_9),

new SqlParameter("@table10_10", table10_10),

new SqlParameter("@table10_11", table10_11),

new SqlParameter("@dateTime", dateTime),

new SqlParameter("@creater", creater)

#endregion

};

int result2 = SqlhelperClass.sqlHelper.ExecuteNonQuery(insertSql, CommandType.Text, parameters2);

MessageBox.Show("当前页面所有数据存档成功!");

}

else

{

string updateSql = "update [dbo].[1swtabledata] set [table8_1]=@table8_1, [table8_2]=@table8_2,[table8_3]=@table8_3,[table8_4]=@table8_4,[table8_5]=@table8_5,[table8_6]=@table8_6,[table8_7]=@table8_7,[table8_8]=@table8_8,[table8_9]=@table8_9,[table8_10]=@table8_10, [table8_11]=@table8_11,[table9_1]=@table9_1, [table9_2]=@table9_2,[table9_4]=@table9_4,[table9_5]=@table9_5,[table9_6]=@table9_6,[table9_7]=@table9_7,[table9_8]=@table9_8,[table9_9]=@table9_9,[table9_10]=@table9_10,[table9_11]=@table9_11,[table9_12]=@table9_12,[table9_13]=@table9_13,[table9_14]=@table9_14,[table9_15]=@table9_15,[table9_16]=@table9_16,[table9_17]=@table9_17,[table9_18]=@table9_18,[table9_19]=@table9_19,[table9_20]=@table9_20,[table9_21]=@table9_21,[table9_22]=@table9_22,[table9_23]=@table9_23,[table9_24]=@table9_24,[table9_25]=@table9_25,[table9_26]=@table9_26,[table10_1]=@table10_1,[table10_2]=@table10_2,[table10_3]=@table10_3,[table10_4]=@table10_4,[table10_5]=@table10_5,[table10_6]=@table10_6,[table10_7]=@table10_7,[table10_8]=@table10_8,[table10_9]=@table10_9,[table10_10]=@table10_10,[table10_11]=@table10_11,[dateTime]=@dateTime,[creater]=@creater where [table9_orderNo]=@table9_orderNo;";

//创建 SQL 参数数组

SqlParameter[] parameters2 = new SqlParameter[]

{

#region 防注入

new SqlParameter("@table9_orderNo", table9_orderNo),

new SqlParameter("@table8_1", table8_1),

new SqlParameter("@table8_2", table8_2),

new SqlParameter("@table8_3", table8_3),

new SqlParameter("@table8_4", table8_4),

new SqlParameter("@table8_5", table8_5),

new SqlParameter("@table8_6", table8_6),

new SqlParameter("@table8_7", table8_7),

new SqlParameter("@table8_8", table8_8),

new SqlParameter("@table8_9", table8_9),

new SqlParameter("@table8_10", table8_10),

new SqlParameter("@table8_11", table8_11),

new SqlParameter("@table9_1", table9_1),

new SqlParameter("@table9_2", table9_2),

new SqlParameter("@table9_4", table9_4),

new SqlParameter("@table9_5", table9_5),

new SqlParameter("@table9_6", table9_6),

new SqlParameter("@table9_7", table9_7),

new SqlParameter("@table9_8", table9_8),

new SqlParameter("@table9_9", table9_9),

new SqlParameter("@table9_10", table9_10),

new SqlParameter("@table9_11", table9_11),

new SqlParameter("@table9_12", table9_12),

new SqlParameter("@table9_13", table9_13),

new SqlParameter("@table9_14", table9_14),

new SqlParameter("@table9_15", table9_15),

new SqlParameter("@table9_16", table9_16),

new SqlParameter("@table9_17", table9_17),

new SqlParameter("@table9_18", table9_18),

new SqlParameter("@table9_19", table9_19),

new SqlParameter("@table9_20", table9_20),

new SqlParameter("@table9_21", table9_21),

new SqlParameter("@table9_22", table9_22),

new SqlParameter("@table9_23", table9_23),

new SqlParameter("@table9_24", table9_24),

new SqlParameter("@table9_25", table9_25),

new SqlParameter("@table9_26", table9_26),

new SqlParameter("@table10_1", table10_1),

new SqlParameter("@table10_2", table10_2),

new SqlParameter("@table10_3", table10_3),

new SqlParameter("@table10_4", table10_4),

new SqlParameter("@table10_5", table10_5),

new SqlParameter("@table10_6", table10_6),

new SqlParameter("@table10_7", table10_7),

new SqlParameter("@table10_8", table10_8),

new SqlParameter("@table10_9", table10_9),

new SqlParameter("@table10_10", table10_10),

new SqlParameter("@table10_11", table10_11),

new SqlParameter("@dateTime", dateTime),

new SqlParameter("@creater", creater)

#endregion

};

int result2 = SqlhelperClass.sqlHelper.ExecuteNonQuery(updateSql, CommandType.Text, parameters2);

MessageBox.Show("当前页面所有数据更新成功!");

}

}

#region 赋值给截面下拉清单

// 调用ExecuteScalar方法的示例

string queryString2 = "select ROW_NUMBER() OVER (ORDER BY [table9_orderNo]) AS ID, [table9_orderNo] from [dbo].[1swtabledata]"; // 这里是一个没有参数的SQL查询

DataTable result3 = SqlhelperClass.sqlHelper.ExecuteDataTable(queryString2, CommandType.Text);

// 遍历DataTable的每一行

List<KeyValuePair<string, string>> lstCom = new List<KeyValuePair<string, string>>();

foreach (DataRow row in result3.Rows)

{

// 假设第一列是Key,第二列是Value

string key = row["ID"].ToString();

string value = row["table9_orderNo"].ToString();

// 创建KeyValuePair并添加到列表中

lstCom.Add(new KeyValuePair<string, string>(key, value));

}

this.ucCombox_type.Source = lstCom;

#endregion

}

catch (Exception ex)

{

Serilog.Log.Error(ex.Message);

MessageBox.Show(ex.Message + "-请确认SolidWorks软件是否已经正常打开");

}

相关推荐
让学习成为一种生活方式11 分钟前
解析药用植物重楼甾体皂苷生物合成中的连续糖基化及其抗真菌作用-文献精读49
linux·数据库·算法·天然产物化学
__water32 分钟前
『功能项目』战士的伤害型技能【45】
c#·unity引擎·战士职业伤害型技能
dbln1 小时前
MySQL之表的约束
数据库·mysql
isNotNullX1 小时前
HBase在大数据实时处理中的角色
大数据·数据库·hbase
白总Server1 小时前
MySQL在大数据场景应用
大数据·开发语言·数据库·后端·mysql·golang·php
君莫愁。2 小时前
【Unity】检测鼠标点击位置是否有2D对象
unity·c#·游戏引擎
Lingbug2 小时前
.Net日志组件之NLog的使用和配置
后端·c#·.net·.netcore
JY_H2 小时前
MongoDB
数据库·mongodb
咩咩觉主2 小时前
Unity实战案例全解析:PVZ 植物卡片状态分析
unity·c#·游戏引擎
Echo_Lee02 小时前
C#与Python脚本使用共享内存通信
开发语言·python·c#