从C＃创建SQL Server数据库-使用参数

Question

I am trying to put up a code to create a databases from my C# code (asp.net website).

This is my code:

SqlCommand myCommand = new SqlCommand("CREATE DATABASE @dbname", nn);
myCommand.Parameters.Add("dbname", dbname);

myCommand.ExecuteNonQuery();
nn.Close();

well, its not working. its giving me an error:

incorrect syntax near '@dbname'

BUT. if I won't use parameters, people can SQL inj to my database. do you have any idea how can use anything, to get the database name from a textbox. and that people can't SQL inj me database?

Answer 1

You can't use parameters in CREATE DATABASE or other DDL commands.

I'd suggest using SQL Server Management Objects instead of SQL