Sysnet.Common/DBUtil.cs

微信扫码关注公众号，代码整理好后第一时间通知你。

using System;
using System.Collections.Generic;
using System.Data.SqlClient;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace Sysnet.Common
{
    /// <summary>
    ///     Utility classes for dealing with databases.
    /// </summary>
    public static class DBUtil
    {
        /// <summary>
        ///     Creates a SQL command from a command format string and
        ///     parameters to avoid SQL injection attacks.
        /// </summary>
        /// <param name="commandFormatString">
        ///     SQL command string with format substitution points for
        ///     parameters.
        /// </param>
        /// <param name="parameters">Parameters to substitute into the SQL command string.</param>
        /// <returns><see cref="SqlCommand"/> using parameters.</returns>
        public static SqlCommand CreateSqlCommandWithParameters(
            string commandFormatString,
            params object[] parameters)
        {
            SqlCommand command = new SqlCommand();

            Util.RequireNotNullOrEmpty(commandFormatString, "commandFormatString");
            Util.RequireNotNull(parameters, "parameters");

            string[] paramLabels = new string[parameters.Length];
            for (int paramIndex = 0; paramIndex < parameters.Length; paramIndex++)
            {
                paramLabels[paramIndex] = string.Format("@{0}", paramIndex);
                command.Parameters.AddWithValue(paramLabels[paramIndex], parameters[paramIndex]);
            }

            command.CommandText = string.Format(commandFormatString, paramLabels);
            return command;

        } //*** createSqlCommandWithParameters

    } //*** class SqlUtil
}