Oracle中的上功能输入参数

Question

I try to prevent SQL injection in SQL query. I used following code to do it but unfortunately I faced some problem. The query is not running in oracle DB:

strQuery = @"SELECT PASSWORD FROM IBK_USERS where upper(user_id) =upper(:UserPrefix) AND user_suffix=:UserSufix AND STATUS_CODE='1'";
//strQuery = @"SELECT PASSWORD FROM IBK_CO_USERS where user_id = '" + UserPrefix + "' AND user_suffix='" + UserSufix + "' AND STATUS_CODE='1'";

try
{
    ocommand = new OracleCommand();
    if (db.GetConnection().State == ConnectionState.Open)
    {
        ocommand.CommandText = strQuery;
        ocommand.Connection = db.GetConnection();
        ocommand.Parameters.Add(":UserSufix", OracleDbType.Varchar2,ParameterDirection.Input);
        ocommand.Parameters[":UserSufix"].Value = UserSufix;
        ocommand.Parameters.Add(":UserPrefix", OracleDbType.Varchar2,ParameterDirection.Input);
        ocommand.Parameters[":UserPrefix"].Value = UserPrefix.ToUpper();
        odatareader = ocommand.ExecuteReader();
        odatareader.Read();
        if (odatareader.HasRows)
        {

Answer 1

Your parameters shouldn't contain the semicolon : . This is just an indicator in your query that the variable that follows is a parameter, but you don't have to supply that on the .NET side:

ocommand.Parameters["UserSufix"] = ...