Question

public static int ExecuteSql(String Sqlstr, SqlParameter[] param)

public static int ExecuteSql(String Sqlstr, SqlParameter[] param)
{
String ConnStr = GetSqlConnection();
using (SqlConnection conn = new SqlConnection(ConnStr))
{
SqlCommand cmd = new SqlCommand();
cmd.Connection = conn;
cmd.CommandText = Sqlstr;
cmd.Parameters.AddRange(param);
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();
return 1;
}
}
这个方法我要怎么去用它，比如说一个insert语句，参数要怎么传

Answer 1

以insert into user values('username','password')为例有两种方式
第一种：采用字符串拼接
string username="aaaaaaa";
string password="aaaaaaaa";
string sql="insert into user values('"+username+"','"+password+"')";
//方法调用
类名.ExecuteSql(sql,null);

第二种：采用参数化
string username="aaaaaaa";
string password="aaaaaaaa";
OleDbParameter[] p ={
new OleDbParameter("@username",username),
new OleDbParameter("@password",password)
}
string sql="insert into user values('@username','@password')";
//方法调用
类名.ExecuteSql(sql,p);