HttpUtility.UrlEncode防止SQL注入

Question

was using HttpUtility.UrlEncode() to prevent SQL injection on where clauses. However some of the text being input has spaces and replacing them with %20 will stop the query. Is there a better alternative?

Answer 1

Use parameters in your database queries rather than concatenating input. Job done. If that sounds like a lot of work - consider tools like dapper that make it easy:

string name = ...
int regionId = ...
var customers = connection.Query<Customer>(
    "select * from Customers where Name = @name and RegionId = @regionId",
    new { name, regionId }).AsList();

Answer 2

To prevent SQL Injection it is preferred to use SQL Parameters. When working with parameters SQL ensures that the parameters in the query are never executed.

Never construct queries by concatenating strings. Especially when it is input that is untrusted (Received from a user)!

In your case using c# you can take a look here: http://csharp-station.com/Tutorial/AdoDotNet/Lesson06