我找不到在哪里添加参数

Question

我可以对此代码进行哪些更改以防止 sql 注入？

private void button1_Click(object sender, EventArgs e)
        {
               string query = "INSERT INTO person (name_,age_)VALUES('" + txtFirstname.Text + "','" + int.Parse(txtAge.Text) + "')";
               DB.OpenConnection();
               DB.SqlQuery = query;
               DB.ExecuteQuery();
               DB.CloseConnection();
        }

Answer 1

像下面的东西

    string query = "INSERT INTO person (name_,age_) VALUES(@name,@age)";
    MySqlCommand m = new MySqlCommand(query);
    m.Parameters.AddWithValue("@name", txtFirstname.Text);
    m.Parameters.AddWithValue("@age", int.Parse(txtAge.Text));

（或者）

m.Parameters.Add(new MySqlParameter("@name", txtFirstname.Text));