c#中使用sql防注入方式写入数据

try

{

if (this.textBoxTransparent2_3.Text == null || this.textBoxTransparent2_3.Text == "")

{

MessageBox.Show("MIS项目编号是必填项!"); this.textBoxTransparent2_3.Focus(); return;

}

else if (textBoxTransparent_path.Text == "" || textBoxTransparent_path.Text == null)

{

MessageBox.Show("选择将要写入数据的SW工程图!"); this.textBoxTransparent_path.Focus(); return;

}

else

{

#region 写入工程图

tableEight();

tableNine();

tableTen();

MessageBox.Show("写入工程图成功");

#endregion

string table9_orderNo = this.textBoxTransparent2_3.Text;

DateTime dateTime = DateTime.Now;

string creater = global.account;

#region table8

string table8_1 = this.textBoxTransparent_1.Text;

string table8_2 = this.textBoxTransparent_2.Text;

string table8_3 = this.textBoxTransparent_3.Text;

string table8_4 = this.textBoxTransparent_4.Text;

string table8_5 = this.textBoxTransparent_5.Text;

string table8_6 = this.textBoxTransparent_6.Text;

string table8_7 = this.textBoxTransparent_7.Text;

string table8_8 = this.textBoxTransparent_8.Text;

string table8_9 = this.textBoxTransparent_9.Text;

string table8_10 = this.textBoxTransparent_10.Text;

string table8_11 = this.textBoxTransparent_11.Text;

#endregion

#region table9

string table9_1 = this.textBoxTransparent2_1.Text;

string table9_2 = this.textBoxTransparent2_2.Text;

string table9_4 = this.textBoxTransparent2_4.Text;

string table9_5 = this.textBoxTransparent2_5.Text;

string table9_6 = this.textBoxTransparent2_6.Text;

string table9_7 = this.textBoxTransparent2_7.Text;

string table9_8 = this.textBoxTransparent2_8.Text;

string table9_9 = this.textBoxTransparent2_9.Text;

string table9_10 = this.textBoxTransparent2_10.Text;

string table9_11 = this.textBoxTransparent2_11.Text;

string table9_12 = this.textBoxTransparent2_12.Text;

string table9_13 = this.textBoxTransparent2_13.Text;

string table9_14 = this.textBoxTransparent2_14.Text;

string table9_15 = this.textBoxTransparent2_15.Text;

string table9_16 = this.textBoxTransparent2_16.Text;

string table9_17 = this.textBoxTransparent2_17.Text;

string table9_18 = this.textBoxTransparent2_18.Text;

string table9_19 = this.textBoxTransparent2_19.Text;

string table9_20 = this.textBoxTransparent2_20.Text;

string table9_21 = this.textBoxTransparent2_21.Text;

string table9_22 = this.textBoxTransparent2_22.Text;

string table9_23 = this.textBoxTransparent2_23.Text;

string table9_24 = this.textBoxTransparent2_24.Text;

string table9_25 = this.textBoxTransparent2_25.Text;

string table9_26 = this.textBoxTransparent2_26.Text;

#endregion

#region table10

string table10_1 = this.textBoxTransparent3_1.Text;

string table10_2 = this.textBoxTransparent3_2.Text;

string table10_3 = this.textBoxTransparent3_3.Text;

string table10_4 = this.textBoxTransparent3_4.Text;

string table10_5 = this.textBoxTransparent3_5.Text;

string table10_6 = this.textBoxTransparent3_6.Text;

string table10_7 = this.textBoxTransparent3_7.Text;

string table10_8 = this.textBoxTransparent3_8.Text;

string table10_9 = this.textBoxTransparent3_9.Text;

string table10_10 = this.textBoxTransparent3_10.Text;

string table10_11 = this.textBoxTransparent3_11.Text;

#endregion

// 调用ExecuteScalar方法的示例

string queryString = "select table9_orderNo FROM dbo.1swtabledata where table9_orderNo = '" + table9_orderNo + "'"; // 这里是一个没有参数的SQL查询

object result = SqlhelperClass.sqlHelper.ExecuteScalar(queryString, CommandType.Text);

if (result == null) // 如果没有此序列号,则新增数据

{

//如果没有此唯一序列号,就插入新增

// 定义你的 SQL 插入语句

string insertSql = "insert into dbo.1swtabledata (table9_orderNo ,table8_1 ,table8_2 ,table8_3 ,table8_4 ,table8_5 ,table8_6 ,table8_7 ,table8_8 ,table8_9 ,table8_10 ,table8_11 ,table9_1 ,table9_2 ,table9_4 ,table9_5 ,table9_6 ,table9_7 ,table9_8 ,table9_9 ,table9_10 ,table9_11 ,table9_12 ,table9_13 ,table9_14 ,table9_15 ,table9_16 ,table9_17 ,table9_18 ,table9_19 ,table9_20 ,table9_21 ,table9_22 ,table9_23 ,table9_24 ,table9_25 ,table9_26 ,table10_1 ,table10_2 ,table10_3 ,table10_4 ,table10_5 ,table10_6 ,table10_7 ,table10_8 ,table10_9 ,table10_10 ,table10_11,dateTime,creater) values (@table9_orderNo, @table8_1, @table8_2, @table8_3, @table8_4, @table8_5, @table8_6, @table8_7, @table8_8, @table8_9, @table8_10, @table8_11, @table9_1, @table9_2, @table9_4, @table9_5, @table9_6, @table9_7, @table9_8,@table9_9, @table9_10, @table9_11, @table9_12, @table9_13, @table9_14, @table9_15, @table9_16, @table9_17, @table9_18, @table9_19, @table9_20, @table9_21, @table9_22, @table9_23, @table9_24, @table9_25, @table9_26, @table10_1, @table10_2, @table10_3, @table10_4, @table10_5, @table10_6, @table10_7, @table10_8, @table10_9, @table10_10, @table10_11, @dateTime, @creater);";

//创建 SQL 参数数组

SqlParameter\[\] parameters2 = new SqlParameter\[\]

{

#region 防注入

new SqlParameter("@table9_orderNo", table9_orderNo),

new SqlParameter("@table8_1", table8_1),

new SqlParameter("@table8_2", table8_2),

new SqlParameter("@table8_3", table8_3),

new SqlParameter("@table8_4", table8_4),

new SqlParameter("@table8_5", table8_5),

new SqlParameter("@table8_6", table8_6),

new SqlParameter("@table8_7", table8_7),

new SqlParameter("@table8_8", table8_8),

new SqlParameter("@table8_9", table8_9),

new SqlParameter("@table8_10", table8_10),

new SqlParameter("@table8_11", table8_11),

new SqlParameter("@table9_1", table9_1),

new SqlParameter("@table9_2", table9_2),

new SqlParameter("@table9_4", table9_4),

new SqlParameter("@table9_5", table9_5),

new SqlParameter("@table9_6", table9_6),

new SqlParameter("@table9_7", table9_7),

new SqlParameter("@table9_8", table9_8),

new SqlParameter("@table9_9", table9_9),

new SqlParameter("@table9_10", table9_10),

new SqlParameter("@table9_11", table9_11),

new SqlParameter("@table9_12", table9_12),

new SqlParameter("@table9_13", table9_13),

new SqlParameter("@table9_14", table9_14),

new SqlParameter("@table9_15", table9_15),

new SqlParameter("@table9_16", table9_16),

new SqlParameter("@table9_17", table9_17),

new SqlParameter("@table9_18", table9_18),

new SqlParameter("@table9_19", table9_19),

new SqlParameter("@table9_20", table9_20),

new SqlParameter("@table9_21", table9_21),

new SqlParameter("@table9_22", table9_22),

new SqlParameter("@table9_23", table9_23),

new SqlParameter("@table9_24", table9_24),

new SqlParameter("@table9_25", table9_25),

new SqlParameter("@table9_26", table9_26),

new SqlParameter("@table10_1", table10_1),

new SqlParameter("@table10_2", table10_2),

new SqlParameter("@table10_3", table10_3),

new SqlParameter("@table10_4", table10_4),

new SqlParameter("@table10_5", table10_5),

new SqlParameter("@table10_6", table10_6),

new SqlParameter("@table10_7", table10_7),

new SqlParameter("@table10_8", table10_8),

new SqlParameter("@table10_9", table10_9),

new SqlParameter("@table10_10", table10_10),

new SqlParameter("@table10_11", table10_11),

new SqlParameter("@dateTime", dateTime),

new SqlParameter("@creater", creater)

#endregion

};

int result2 = SqlhelperClass.sqlHelper.ExecuteNonQuery(insertSql, CommandType.Text, parameters2);

MessageBox.Show("当前页面所有数据存档成功!");

}

else

{

string updateSql = "update dbo.1swtabledata set table8_1=@table8_1, table8_2=@table8_2,table8_3=@table8_3,table8_4=@table8_4,table8_5=@table8_5,table8_6=@table8_6,table8_7=@table8_7,table8_8=@table8_8,table8_9=@table8_9,table8_10=@table8_10, table8_11=@table8_11,table9_1=@table9_1, table9_2=@table9_2,table9_4=@table9_4,table9_5=@table9_5,table9_6=@table9_6,table9_7=@table9_7,table9_8=@table9_8,table9_9=@table9_9,table9_10=@table9_10,table9_11=@table9_11,table9_12=@table9_12,table9_13=@table9_13,table9_14=@table9_14,table9_15=@table9_15,table9_16=@table9_16,table9_17=@table9_17,table9_18=@table9_18,table9_19=@table9_19,table9_20=@table9_20,table9_21=@table9_21,table9_22=@table9_22,table9_23=@table9_23,table9_24=@table9_24,table9_25=@table9_25,table9_26=@table9_26,table10_1=@table10_1,table10_2=@table10_2,table10_3=@table10_3,table10_4=@table10_4,table10_5=@table10_5,table10_6=@table10_6,table10_7=@table10_7,table10_8=@table10_8,table10_9=@table10_9,table10_10=@table10_10,table10_11=@table10_11,dateTime=@dateTime,creater=@creater where table9_orderNo=@table9_orderNo;";

//创建 SQL 参数数组

SqlParameter\[\] parameters2 = new SqlParameter\[\]

{

#region 防注入

new SqlParameter("@table9_orderNo", table9_orderNo),

new SqlParameter("@table8_1", table8_1),

new SqlParameter("@table8_2", table8_2),

new SqlParameter("@table8_3", table8_3),

new SqlParameter("@table8_4", table8_4),

new SqlParameter("@table8_5", table8_5),

new SqlParameter("@table8_6", table8_6),

new SqlParameter("@table8_7", table8_7),

new SqlParameter("@table8_8", table8_8),

new SqlParameter("@table8_9", table8_9),

new SqlParameter("@table8_10", table8_10),

new SqlParameter("@table8_11", table8_11),

new SqlParameter("@table9_1", table9_1),

new SqlParameter("@table9_2", table9_2),

new SqlParameter("@table9_4", table9_4),

new SqlParameter("@table9_5", table9_5),

new SqlParameter("@table9_6", table9_6),

new SqlParameter("@table9_7", table9_7),

new SqlParameter("@table9_8", table9_8),

new SqlParameter("@table9_9", table9_9),

new SqlParameter("@table9_10", table9_10),

new SqlParameter("@table9_11", table9_11),

new SqlParameter("@table9_12", table9_12),

new SqlParameter("@table9_13", table9_13),

new SqlParameter("@table9_14", table9_14),

new SqlParameter("@table9_15", table9_15),

new SqlParameter("@table9_16", table9_16),

new SqlParameter("@table9_17", table9_17),

new SqlParameter("@table9_18", table9_18),

new SqlParameter("@table9_19", table9_19),

new SqlParameter("@table9_20", table9_20),

new SqlParameter("@table9_21", table9_21),

new SqlParameter("@table9_22", table9_22),

new SqlParameter("@table9_23", table9_23),

new SqlParameter("@table9_24", table9_24),

new SqlParameter("@table9_25", table9_25),

new SqlParameter("@table9_26", table9_26),

new SqlParameter("@table10_1", table10_1),

new SqlParameter("@table10_2", table10_2),

new SqlParameter("@table10_3", table10_3),

new SqlParameter("@table10_4", table10_4),

new SqlParameter("@table10_5", table10_5),

new SqlParameter("@table10_6", table10_6),

new SqlParameter("@table10_7", table10_7),

new SqlParameter("@table10_8", table10_8),

new SqlParameter("@table10_9", table10_9),

new SqlParameter("@table10_10", table10_10),

new SqlParameter("@table10_11", table10_11),

new SqlParameter("@dateTime", dateTime),

new SqlParameter("@creater", creater)

#endregion

};

int result2 = SqlhelperClass.sqlHelper.ExecuteNonQuery(updateSql, CommandType.Text, parameters2);

MessageBox.Show("当前页面所有数据更新成功!");

}

}

#region 赋值给截面下拉清单

// 调用ExecuteScalar方法的示例

string queryString2 = "select ROW_NUMBER() OVER (ORDER BY table9_orderNo) AS ID, table9_orderNo from dbo.1swtabledata"; // 这里是一个没有参数的SQL查询

DataTable result3 = SqlhelperClass.sqlHelper.ExecuteDataTable(queryString2, CommandType.Text);

// 遍历DataTable的每一行

List<KeyValuePair<string, string>> lstCom = new List<KeyValuePair<string, string>>();

foreach (DataRow row in result3.Rows)

{

// 假设第一列是Key,第二列是Value

string key = row"ID".ToString();

string value = row"table9_orderNo".ToString();

// 创建KeyValuePair并添加到列表中

lstCom.Add(new KeyValuePair<string, string>(key, value));

}

this.ucCombox_type.Source = lstCom;

#endregion

}

catch (Exception ex)

{

Serilog.Log.Error(ex.Message);

MessageBox.Show(ex.Message + "-请确认SolidWorks软件是否已经正常打开");

}

相关推荐
填满你的记忆5 小时前
10万QPS下,Redis缓存如何避免雪崩?
数据库·redis·缓存
IT界的老黄牛5 小时前
MongoDB 主从切换排查实战:从 docker ps 到 jq,一套 SOP 定位死因
数据库·mongodb·docker
睡不醒男孩0308235 小时前
第四篇:数据库国产化与信创替代的守护者:基于CLup的异构数据库一站式运维平台构建
运维·数据库·金融·clup·中启乘数
Lumistory5 小时前
2026年城市照明工程4大核心痛点及解决方案
大数据·数据库
岳麓丹枫0015 小时前
PG数据库无法接受连接问题分析定位
数据库·postgresql
itgather6 小时前
OfficeExcel — Word / Excel DLL 验证台功能介绍
c#·word·excel
JdSnE27zv6 小时前
SQLite内存数据库
数据库·sql·sqlite
SelectDB技术团队6 小时前
预约发布会|核心产品力首发,如何构建面向 Agent 时代的企业级数据引擎
数据库·数据仓库·人工智能·数据分析·可观测·apache doris·selectdb
2601_961845156 小时前
2026四级作文预测题|英语四级写作押题+提纲PDF
java·c语言·数据库·c++·python·pdf·php
云中小生6 小时前
Scrutor:.NET 依赖注入自动化的优雅实现
c#·.net