编辑“︁C Sharp 参数化查询”︁（章节）

== 实际案例 ==
=== 用户登录系统 ===
安全实现用户认证的典型示例：

<syntaxhighlight lang="csharp">
public bool AuthenticateUser(string username, string password)
{
    string sql = @"SELECT COUNT(*) FROM Users 
                  WHERE Username = @username 
                  AND PasswordHash = HASHBYTES('SHA2_256', @password)";
    
    using (var connection = new SqlConnection(connectionString))
    {
        var command = new SqlCommand(sql, connection);
        command.Parameters.AddWithValue("@username", username);
        command.Parameters.AddWithValue("@password", password);
        
        connection.Open();
        int result = (int)command.ExecuteScalar();
        return result > 0;
    }
}
</syntaxhighlight>

=== 报表查询 ===
安全处理用户提供的过滤条件：

<syntaxhighlight lang="csharp">
public DataTable GetSalesReport(DateTime? startDate, DateTime? endDate, int? categoryId)
{
    string sql = "SELECT * FROM Sales WHERE 1=1";
    var parameters = new List<SqlParameter>();
    
    if (startDate.HasValue)
    {
        sql += " AND SaleDate >= @startDate";
        parameters.Add(new SqlParameter("@startDate", startDate.Value));
    }
    
    if (endDate.HasValue)
    {
        sql += " AND SaleDate <= @endDate";
        parameters.Add(new SqlParameter("@endDate", endDate.Value));
    }
    
    // 执行查询...
}
</syntaxhighlight>