Question

I want to change a password for a user in MySQL which requires @ symbol. However, C# SQL command uses that as a parameter holder and because of that the following command fails.

command.CommandText =$ “ALTER USER{user} @ %ENT IDIFIED BY{password}”;

如何使用字面<条码><<<><>>>/代码>?

我知道Kingk的注射问题。我正在奥连一度地这样做,以便进行一些数据迁移。

Answer 1

MySQL联系人:试图将 s/a>用于执行指定参数,似乎没有出路躲避。 Luckily, You're using @ % , and >@ % is theault.。

command.CommandText = $"ALTER USER  {user}  IDENTIFIED BY  {password} ";

你甚至可能能够使用参数。如果这项工作可行,你就应当——一次性工作,它只是更清洁的。

command.CommandText = "ALTER USER @User IDENTIFIED BY @Password";
command.Parameters.AddWithValue("@User", user);
command.Parameters.AddWithValue("@Password", password);

友情链接