23 lines
807 B
Plaintext
23 lines
807 B
Plaintext
== Parameterized Queries - .NET
|
|
-------------------------------------------------------
|
|
public static bool isUsernameValid(string username) {
|
|
RegEx r = new Regex("^[A-Za-z0-9]{16}$");
|
|
Return r.isMatch(username);
|
|
}
|
|
|
|
// SqlConnection conn is set and opened elsewhere for brevity.
|
|
try {
|
|
string selectString = "SELECT * FROM user_table WHERE username = @userID";
|
|
SqlCommand cmd = new SqlCommand( selectString, conn );
|
|
if ( isUsernameValid( uid ) ) {
|
|
cmd.Parameters.Add( "@userID", SqlDbType.VarChar, 16 ).Value = uid;
|
|
SqlDataReader myReader = cmd.ExecuteReader();
|
|
if ( myReader ) {
|
|
// make the user record active in some way.
|
|
myReader.Close();
|
|
}
|
|
} else { // handle invalid input }
|
|
}
|
|
catch (Exception e) { // Handle all exceptions... }
|
|
-------------------------------------------------------
|