使用order by在C#中连接SQL

Question

我有这个代码,我想写,ORDER BY DESC但我不知道怎么可以请一些人请帮忙

OleDbCommand cmd = new OleDbCommand("SELECT * FROM users WHERE [id] = " + Session_ID, conn2);

Answer 1

首先,您应该知道这种代码对SQL注入是开放的,您应该始终使用参数化查询来避免SQL注入.像这样:

OleDbCommand cmd = new OleDbCommand("SELECT * FROM users WHERE [id] = ? " +
                                    "ORDER BY ID DESC", conn2);
cmd.Parameters.Add(new OleDbParameter("@SessionID", Session_ID));