c# + mysql防SQL注入方法

/// <summary>

/// 替换SQL注入的危险字符

/// </summary>

/// <param name="param"></param>

/// <returns></returns>

public static string ReplaceInjectString(string param)

{

if (string.IsNullOrEmpty(param))

return string.Empty;

var result = new StringBuilder(param);

return result

.Replace("'", "'")

.Replace(",", ",")

.Replace(";", ";")

.Replace("(", "(")

.Replace("=", "=")

.Replace("*", "*")

.Replace("&", "&")

.ToString();

}