数据库操作 (防注入攻击)
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; using System.Data.SqlClient; namespace ConsoleApplication1 { class Program { static void Main(string[] args) { Console.WriteLine("请输入要查询的汽车代号:"); string code = Console.ReadLine(); SqlConnection conn = new SqlConnection("server=.;database=mydb;user=sa;pwd=1023823348"); SqlCommand cmd = conn.CreateCommand(); cmd.CommandText = "select * from car where code=@code"; cmd.Parameters.Clear(); cmd.Parameters.AddWithValue("@code",code); conn.Open(); SqlDataReader dr = cmd.ExecuteReader(); if (dr.HasRows) { while (dr.Read()) { Console.WriteLine(dr[0] + "--" + dr[1]); Console.WriteLine("输入1删除该数据 输入2修改数据 输入3添加数据"); } int a = int.Parse(Console.ReadLine()); dr.Close(); if (a == 1) { cmd.CommandText = "delete from car where Code=@code"; cmd.ExecuteNonQuery(); Console.WriteLine("删除成功!"); } else if (a == 2) { Console.WriteLine("请输入内容"); string name = Console.ReadLine(); cmd.CommandText = "update car set name=@name where code=@code "; cmd.Parameters.Clear(); cmd.Parameters.AddWithValue("@name", name); cmd.Parameters.AddWithValue("@code", code); cmd.ExecuteNonQuery(); Console.WriteLine("修改成功!"); } else if (a == 3) { Console.WriteLine("请输入"); string code2 = Console.ReadLine(); Console.WriteLine("请输入内容名字"); string name = Console.ReadLine(); Console.WriteLine("请输入系列编号"); string brand = Console.ReadLine(); Console.WriteLine("请输入内容日期"); string time = Console.ReadLine(); Console.WriteLine("请输入内容油耗*.**"); double oil =double.Parse( Console.ReadLine()); Console.WriteLine("请输入内容马力"); int powers = int.Parse(Console.ReadLine()); Console.WriteLine("请输入内容"); int exhaust = int.Parse(Console.ReadLine()); Console.WriteLine("请输入内容"); double price =double.Parse( Console.ReadLine()); Console.WriteLine("请输入内容"); string pic = Console.ReadLine(); cmd.CommandText = "insert into car values( @code,@name,@brand,@time,@oil,@powers,@exhaust,@price,@pic)"; cmd.Parameters.Clear(); cmd.Parameters.AddWithValue("@code", code2); cmd.Parameters.AddWithValue("@name", name); cmd.Parameters.AddWithValue("@brand", brand); cmd.Parameters.AddWithValue("@time", time); cmd.Parameters.AddWithValue("@oil", oil); cmd.Parameters.AddWithValue("@powers", powers); cmd.Parameters.AddWithValue("@exhaust", exhaust); cmd.Parameters.AddWithValue("@price", price); cmd.Parameters.AddWithValue("@pic", pic); cmd.ExecuteNonQuery(); Console.WriteLine("添加成功!"); } else { Console.WriteLine("错误"); } } else { Console.WriteLine("没有查到相应的数据"); } conn.Close(); Console.ReadLine(); } } }