使用MySQL参数创建新用户

Question

So I am using a MySQL Server version 8.0.16 and if I try to let dynamically create a new user, i do receive a Error message what says: >>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax. to use near '$password' at line 1<<.

What i can't understand, becouse if i replace the Parameters with the actual value and try it with the shell it works perfectly. I let my code connect as root so and checked if the connection is open what it is. So if I stepped into the code and checked if the parameters are correct everything looked fine. I also added >>'<< at the beginning and end of thext strings that should replace the parameters but it didn't changed the error or what happened.

public bool CreateNewUser(string name, string password, string host)
{
   string query = "CREATE USER $name@$host IDENTIFIED BY $password;";
   List<MySqlParameter> mies = new List<MySqlParameter>
   {
      new MySqlParameter("$name", name),
      new MySqlParameter("$password", password),
      new MySqlParameter("$host", host)
   };

   return InsertIntoQuery(query, mies);
}

//The InsertIntoQuery looks like this

private bool InsertIntoQuery(string sql, List<MySqlParameter> sqlParameters = null)
{
   bool retBl = false;
   try
   {
      using (var SqlConnection = new MySqlConnection(ConnectionStr))
      {
         SqlConnection.Open();
         using (var cmd = new MySqlCommand(sql, SqlConnection))
         {
            if (sqlParameters != null)
               foreach (var item in sqlParameters)
                  cmd.Parameters.AddWithValue(item.ParameterName, item.Value);
            cmd.Prepare();
            var retValNonQuery = cmd.ExecuteNonQuery();

            retBl = (retValNonQuery > 0) ? true : false;
         }
      }
   }
   catch (Exception e)
   {
      MessageBox.Show("Error: " + e.Message);
   }
   return retBl;
}

I would expect it to create a new user but it doesn't.

Answer 1

No, for CREATE USER command I don't think you can pass command parameter likewise. Rather substitute the value as is like below using string interpolation syntax.

string query = $"CREATE USER '{name}@{host} IDENTIFIED BY {password}";

For an older C# version consider using string.Format()

string query = string.Format("CREATE USER '{0}'@'{1}' IDENTIFIED BY '{2}'",name,host,password);

Per OP's comment: You can't cause it's not a DML operation. If you are worried about SQL Injection probably cause input value is coming from user input then you will have sanitize it someway and moreover if you observe the input are quoted.

Again, I would suggest that this kind of admin operation should go in a DB bootstrap script and not in your application code.