担心 Winforms 项目中的 SQL 注入有什么意义吗？
在 SO 和其他地方，如果没有人礼貌地指出最好使用参数化输入和存储过程，则几乎不可能在示例代码中发布长连接的 SQL 指令。
最近的示例 在这里。
但是担心 Winforms 项目中的 SQL 注入有意义吗？
In SO and elsewhere it's nearly impossible to post long concatenated SQL instructions in sample code without someone politely pointing out that it's better to use parameterized input and stored procedures.
Recent example here.
But is it meaningful to worry about SQL injection in a Winforms project?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
有什么理由不编写安全的数据库代码吗？我不这么认为。
每个人都应该养成安全执行 SQL 的习惯，这样你在编写公共应用程序时甚至不必考虑它。
还要考虑到许多原本打算保密的代码最终将在几个月或几年后变得可供公开访问。例如，“嘿，这个用于库存报告的内联网应用程序很有用，为什么我们不将其上传到我们的公共网站以供我们的业务合作伙伴使用？”
1，则按date列排序。如果用户输入2，则按status列排序。Is there some reason not to write safe database code? I don't think so.
Everyone should get into the habit of executing SQL safely, so you won't even have to think about it when you write public apps.
Also consider that a lot of code that's intended to be private will end up becoming accessible publicly months or years later. For example, "hey this intranet app for inventory reporting is useful, why don't we upload it to our public website for our business partners to use?"
1, then sort bydatecolumn. If user enters2then sort bystatuscolumn.现实生活中的史诗故事：中西部公司的老大来查看项目进展。不知道这是怎么发生的，但不知何故，调度办公室为一位从未见过的客户下了一组新订单。大约在老板过来查看的时候就开始生产了。他的姓氏是奥肖内西。
使用参数化输入不仅仅可以避免 SQL 注入。
Epic tale from real life: the Big Boss of the mid-western company came to take a look at project progress. Not sure how it happened, but somehow a new set of orders came down from the scheduling office for a customer never seen before. And went into production around the time the Boss came to have a look. His last name was O'Shaughnessy.
Using parameterized input is good for more than just avoiding SQL Injection.
是的，出于您在其他项目中看到的所有原因。
您的用户群可能较小，但也存在同样的危险。
Yes it is, for all the reasons you've seen on other projects.
Your user base may be smaller but the same dangers are there.