认为你在C#/中已有这一守则。 NET(通过ODBC使用PogreSQL):
using System.Data.Odbc;
...
OdbcCommand cmd = ...;
cmd.CommandText = "SELECT id, email, password FROM users WHERE email=?;";
cmd.Parameters.Clear();
cmd.Parameters.Add("email", OdbcType.VarChar).Value = aEmail;
但当电子邮件=(回击和apos)时,我会发现以下错误:
Exception type: OdbcException
Exception message: ERROR [42601] ERROR: unterminated quoted string at or near " ;";
Error while executing the query
As I ve read, using OdbcCommand.Parameters should protect against SQL injection, but in this case it looks like something doesn t works right, what am I missing?
重要说明:我以前从未使用过PogreSQL、ODBC、NET(今天启动),但我希望今天也停止使用;但我需要在一个简单的网络应用中确定4个问题——以前是:
System.Format("SELECT ... email = {0}", aEmail)