ASP.NET Core Web API 入門教學(5_7) - 新增資料之好想用SQL,一樣要小心SQL Injection
[HttpPost("postSQL")] public void PostSQL([FromBody] TodoListPostDto value) { var name = new SqlParameter("name", value.Name); string sql = @"INSERT INTO [dbo].[TodoList] ([Name] ,[InsertTime] ,[UpdateTime] ,[Enable] ,[Orders] ,[InsertEmployeeId] ,[UpdateEmployeeId]) VALUES (@name,'"+DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")+"','"+ DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss") + "','"+value.Enable+"',"+value.Orders+ ",'00000000-0000-0000-0000-000000000001','00000000-0000-0000-0000-000000000001')"; _todoContext.Database.ExecuteSqlRaw(sql, name); }參考資料:Entity Framework Core原始 SQL 查詢
技術提供:Blogger.