023. Asp.net参数化查询预防Sql注入攻击

/// <summary>
    /// 参数化查询预防SQL注入式攻击
    /// </summary>
    public int checkLogin(string loginName, string loginPwd)
    {
        string strsql = "select count(*) from tb_LoginUser where UserName=@UserName and PassWord=@PassWord";
        SqlConnection conn = new SqlConnection(ConfigurationManager.AppSettings["conStr"]);
        if (conn.State.Equals(ConnectionState.Closed))//存在，判断是否关闭
        {
            conn.Open();                             //连接处于关闭状态，重新打开
        }
        SqlCommand sqlcom = new SqlCommand(strsql, conn);
        sqlcom.Parameters.Add(new SqlParameter("@UserName", SqlDbType.NVarChar, 50));
        sqlcom.Parameters["@UserName"].Value = loginName;
        sqlcom.Parameters.Add(new SqlParameter("@PassWord", SqlDbType.NVarChar, 50));
        sqlcom.Parameters["@PassWord"].Value = loginPwd;
        int i = (int)sqlcom.ExecuteScalar();
        conn.Close();
        return i;
    }