• 完整修改删除,占位符防治字符串攻击


    完整修改删除相对于修改删除就是在修改删除之前先进性判断是否有要进行操作的对象,如果有再进行修改或者删除。也就是在修改删除之前先进行查询。

    以修改为例

    static void Main(string[] args)

            {

                bool has = false;//定义一个变量判断是否有该对象

                Console.Write("请输入要修改的用户名:");

                string Uname = Console.ReadLine();

                SqlConnection conn = new SqlConnection("server=.;database=Data0720;user=sa;pwd=123");

                SqlCommand cmd = conn.CreateCommand();

                cmd.CommandText = "select *from Users where UserName='" + Uname + "'";//进行查询

                conn.Open();

                SqlDataReader dr = cmd.ExecuteReader();

                if (dr.HasRows)

                {

                    has = true;

                }

                conn.Close();

                if (has)

                {

                    Console.WriteLine("已经查到[" + Uname + "]用户信息,请进行修改");

                    Console.Write("请输入修改后的密码:");

                    string Pwd = Console.ReadLine();

                    Console.Write("请输入修改后的昵称:");

                    string Nname = Console.ReadLine();

                    Console.Write("请输入修改后的性别:");

                    string Sex = Console.ReadLine();

                    Console.Write("请输入修改后的生日:");

                    string Birthday = Console.ReadLine();

                    Console.Write("请输入修改后的民族:");

                    string Nation = Console.ReadLine();

                    //@key  占位符 

                    cmd.CommandText = " update Users set PassWord=@pwd,NickName=@nname,Sex=@sex,Birthday=@bir,Nation=@nat where UserName=@uname;";

                    cmd.Parameters.Clear();

                    cmd.Parameters.Add("@pwd", Pwd);

                    cmd.Parameters.Add("@nname",Nname);

                    cmd.Parameters.Add("@sex", (Sex=="男")?"1":"0");

                    cmd.Parameters.Add("@bir", Birthday);

                    cmd.Parameters.Add("@nat", Nation);

                    cmd.Parameters.Add("@uname", Uname);

                    conn.Open();

                    cmd.ExecuteNonQuery();

                    conn.Close();

                    Console.WriteLine("修改完毕!");

                }

                else

                {

                    Console.WriteLine("未查到[" + Uname + "]用户信息,请确认用户名输入是否正确!");

                }

                Console.ReadLine();

            }

  • 相关阅读:
    微信小程序之坑(一) JESSIONID一直变动问题
    spring 异常org.springframework.dao.IncorrectResultSizeDataAccessException: query did not return a unique result: 2
    springdatajpa之坑(一)
    AOP实战
    spingboot pom文件 打成war 包 热部署 引入第三方jar包
    javax.persistence.EntityExistsException: A different object with the same identifier value was already associated with the session 解决办法
    判断请求来自手机还是PC
    存储过程
    jfinal 连接oracle 数据库把外键当成主键 在mappingkit文件里生成多个主键解决办法
    oracle 回复以前的数据
  • 原文地址:https://www.cnblogs.com/lanrenqilanming/p/5880075.html
Copyright © 2020-2023  润新知