SQL CLR存储过程是否可以防止注入？

我已经用C#编写了这样的CLR存储过程

[Microsoft.SqlServer.Server.SqlProcedure]
public static void IsUserNameExists(string strUserName, out SqlBoolean returnValue)
{      
    using (SqlConnection connection = new SqlConnection("context connection=true"))
    {
        connection.Open();
        SqlCommand command = new SqlCommand("Select count(UserName) from [User] where UserName='" + strUserName + "'", connection);

        int nHowMany = int.Parse(command.ExecuteScalar().ToString());

        if (nHowMany > 0)
            returnValue = true;
        else
            returnValue = false;
    }
}

它容易受到SQL注入的攻击吗？我正在使用SqlParameter.有什么最好的做法吗？

解决方法:

默认情况下,CLR存储过程不会阻止此操作.您需要自己执行此操作,因为CLR不会自动执行此操作(我想这是您想知道的实际问题)

像这样更新您的代码,您应该一切都很好.

 [Microsoft.SqlServer.Server.SqlProcedure]
    public static void IsUserNameExists(string strUserName, out SqlBoolean returnValue)
    {
        using (SqlConnection connection = new SqlConnection("context connection=true"))
        {
            connection.Open();
            SqlCommand command = new SqlCommand("Select count(UserName) from [User] where UserName=@UserName", connection);
            command.Parameters.Add(new SqlParameter("@UserName", strUserName));

            int nHowMany = int.Parse(command.ExecuteScalar().ToString());

            if (nHowMany > 0)
                returnValue = true;
            else
                returnValue = false;
        }
    }

标签：sql-injection,clrstoredprocedure,c
来源： https://codeday.me/bug/20191031/1972090.html