按顺序将C＃中的SQL连接起来

Question

我有此代码，我想编写ORDER BY DESC但我不知道该如何帮助一些人

OleDbCommand cmd = new OleDbCommand("SELECT * FROM users WHERE [id] = " + Session_ID, conn2);

Answer 1

Firstly, you should be aware that this kind of codes are open for SQL Injection and you should always use parameterized queries to avoid SQL Injection . Like this:

OleDbCommand cmd = new OleDbCommand("SELECT * FROM users WHERE [id] = ? " +
                                    "ORDER BY ID DESC", conn2);
cmd.Parameters.Add(new OleDbParameter("@SessionID", Session_ID));

Answer 2

 OleDbCommand cmd = new OleDbCommand("SELECT * FROM users 
  WHERE [id] = " + Session_ID + " ORDER BY ID DESC", conn2);

Though above will work it has serious flaw. One can simply do SQL Injection in above SQL Query so it is highly recommended to use parametrized query to prevent SQL Injection as suggested by @S.Akbari