C#使用预处理SQL语句访问MySQL的方法，具体代码如下：
MySqlConnection con = null; MySqlCommand cmd = null; string nameStr = "Sample value passed \”"; con = new MySqlConnection("server=localhost;database=db_name;uid=user;pwd=password;pooling=false;"); con.Open(); cmd = new MySqlCommand("insert into MyTable values (null, ?ParName);", con); cmd.Parameters.AddWithValue("?ParName", (string)nameStr.Replace("\"", "^")); cmd.ExecuteNonQuery(); con.Close(); MySqlConnection con = null; MySqlCommand cmd = null; string nameStr = "Sample value passed \”"; con = new MySqlConnection("server=localhost;database=db_name;uid=user;pwd=password;pooling=false;"); con.Open(); cmd = new MySqlCommand("insert into MyTable values (null, ?ParName);", con); cmd.Parameters.AddWithValue("?ParName", (string)nameStr.Replace("\"", "^")); cmd.ExecuteNonQuery(); con.Close();
参数通过问号开头，比如?ParName
然后建立Command
再通过设置
.Parameters.AddWithValue设置每个参数的值就行了。