Browse Source

SqlClient,在 SQL 中使用安全的语句

master
王厅 1 week ago
parent
commit
10b9a1ae3b
  1. 26
      Apewer.Source/Source/SqlClient.cs

26
Apewer.Source/Source/SqlClient.cs

@ -185,9 +185,9 @@ namespace Apewer.Source
var values = new List<string>(psc); var values = new List<string>(psc);
foreach (var column in ps) foreach (var column in ps)
{ {
//names.Add(TextGenerator.Merge("[", column, "]"));
names.Add(TextUtility.Merge(column)); names.Add($"[{column.ParameterName}]");
values.Add("@" + column); values.Add("@" + column.ParameterName);
} }
var sb = new StringBuilder(); var sb = new StringBuilder();
sb.Append("insert into ", table, "(", string.Join(", ", names.ToArray()), ") "); sb.Append("insert into ", table, "(", string.Join(", ", names.ToArray()), ") ");
@ -233,7 +233,7 @@ namespace Apewer.Source
foreach (var p in ps) foreach (var p in ps)
{ {
var pn = p.ParameterName; var pn = p.ParameterName;
items.Add(TextUtility.Merge("[", pn, "] = @", pn)); items.Add($"[{pn}] = @{pn}");
} }
var key = record.Key.SafeKey(); var key = record.Key.SafeKey();
var sql = $"update {table} set {string.Join(", ", items.ToArray())} where [{structure.Key.Field}]='{key}'"; var sql = $"update {table} set {string.Join(", ", items.ToArray())} where [{structure.Key.Field}]='{key}'";
@ -665,33 +665,33 @@ COLLATE Chinese_PRC_CI_AS
type = "datetime"; type = "datetime";
break; break;
case ColumnType.VarChar: case ColumnType.VarChar:
type = TextUtility.Merge("varchar(", Math.Min(8000, length).ToString(), ")"); type = $"varchar({Math.Min(8000, length)})";
break; break;
case ColumnType.VarChar191: case ColumnType.VarChar191:
type = TextUtility.Merge("varchar(191)"); type = "varchar(191)";
break; break;
case ColumnType.VarCharMax: case ColumnType.VarCharMax:
type = TextUtility.Merge("varchar(max)"); type = "varchar(max)";
break; break;
case ColumnType.Text: case ColumnType.Text:
type = TextUtility.Merge("text"); type = "text";
break; break;
case ColumnType.NVarChar: case ColumnType.NVarChar:
type = TextUtility.Merge("nvarchar(", Math.Min(4000, length).ToString(), ")"); type = $"nvarchar({Math.Min(4000, length)})";
break; break;
case ColumnType.NVarChar191: case ColumnType.NVarChar191:
type = TextUtility.Merge("nvarchar(191)"); type = "nvarchar(191)";
break; break;
case ColumnType.NVarCharMax: case ColumnType.NVarCharMax:
type = TextUtility.Merge("nvarchar(max)"); type = "nvarchar(max)";
break; break;
case ColumnType.NText: case ColumnType.NText:
type = TextUtility.Merge("ntext"); type = "ntext";
break; break;
default: default:
return TextUtility.Empty; return TextUtility.Empty;
} }
return TextUtility.Merge("[", vcolumn.Field, "] ", type); return $"[{vcolumn.Field}] {type}";
} }
#endregion #endregion

Loading…
Cancel
Save