程序中一种用in的sql防注入的方法(小技巧)

        实际就是拼一个动态的静态参数,随便一写,别挑语法,呵呵

        string s = "'2'OR 1=1 --'";
        int i = 10;
        SqlParameter[] parameters = new SqlParameter[i];
        for (int j = 0; j < i; j++)
        {
            parameters[j] = new SqlParameter("@s"+j.ToString(), SqlDbType.VarChar);
            parameters[j].Value = s;
        }
        string sql = "Select * from Test where A in (";
        for (int j = 0; j < i; j++)
        {
            sql += "@s" + j.ToString()+",";
        }
        sql = sql.TrimEnd(',');
        sql += ")";
        //ExecuteSql(sql, parameters)执行