参数化解决sql注入

用DynamicParameters:

string where = " where a.is_deleted=0 and a.bvent_id=@bventId and au.user_type=0  and au.attendee_type=0 ";

            var dyParam = new DynamicParameters();
dyParam.Add("@bventId", query.BventId);
if (query.Ids != null && query.Ids.Any())
{
var ids = string.Join(",", query.Ids);
where += $" and a.id in @ids "; dyParam.Add("@ids", ids);
} if (query.SearchType == SearchType.Simple)
{
// 简单搜索
if (!string.IsNullOrWhiteSpace(query.SimpleSearchValue))
{
where += $" and (a.full_name like @keyword or a.mobile like @keyword or a.email like @keyword )";            
dyParam.Add("@keyword", $"%{query.SimpleSearchValue}%");
}
}var guests = await _dapperAsyncExecutor.QueryAsync<GuestViewModel>($"{sql} {where}".AsPaginatedSql(pageIndex, pageSize), dyParam);
上一篇:vue 获取数据联动下拉框select ,并解决报Duplicate value found in v-for="...": "". Use track-by="$index" 错误


下一篇:建立表空间和用户