方法1
<SCRIPT language="JavaScript">
function IsValid( oField )
{
re= /select|update|delete|exec|count|'|"|=|;|>|<|%/i;
$sMsg = "请您不要在参数中输入特殊字符和SQL关键字！"
if ( re.test(oField.value) )
{
alert( $sMsg );
oField.value = '';
oField.focus();
return false;
}
}
</SCRIPT>
方法2
select * from AdminInfo where UserName='"+TextBox1.text.Replace("'","''")+"' and PassWord='"+TextBox2.Text.Replace("'","''")+"'
方法3
使用參數
comm.Paremeters.Add("@userName",SqlDbType.varchar).Value=Textbox1.text;
comm.Paremeters.Add("@passWord",SqlDbType.varchar).Value=Textbox2.text;
comm.commandText="select * from AdminInfo where UserName=@userName and PassWord=@passWord";
這2种方法都可以防止sql注入式攻擊