SUSERNAME=:USERNAMEANDSPASSWORD=:PASSWORD";OracleParameter[]parms={newOracleParameter("USERNAME",OracleType.VarChar),newOracleParameter("PASSWORD",OracleType.VarChar),};parms[0].Value=userName;parms[1].Value=password;stringsql="SELEC

Question

S_USERNAME=:USERNAME AND S_PASSWORD=:PASSWORD";
OracleParameter[] parms = {
new OracleParameter("USERNAME",OracleType.VarChar),
new OracleParameter("PASSWORD",OracleType.VarChar),
};
parms[0].Value = userName;
parms[1].Value = password;
string sql = "SELECT * FROM TBL_C_USER WHERE S_USERNAME=:USERNAME AND S_PASSWORD=:PASSWORD";
这是什么用法?要实现怎样的功能?尤其是S_USERNAME=:USERNAME AND S_PASSWORD=:PASSWORD 很诡异?没见过

Answer 1

冒号:后面的是定义的参数组的KEY,比如USERNAME,它的值是之前附的userName
相比直接"SELECT * FROM TBL_C_USER WHERE S_USERNAME='"+userName+"'AND S_PASSWORD='"password'"
这样传入可以避免SQL注入