Take login as an example. Suppose the login statement is the string SQL = "Select Count (user. ID) from sys _ user user where user。 user _ name = '？' And user_pwd ='?' "If the parameters user_name and usre_pwd are not encrypted.

When user_name is English', an sql error, "The string in quotation marks did not end correctly" and so on will be reported. If such an error is caught by the foreground, then your sys_user table cannot be managed. When the parameter user_name or user_pwd is' or 1 = 1-, the spelling sql language holds. Situations like this are relatively simple injection attacks, so it is best to convert foreground parameters into symbols or strings that are not used by the database. At present, the most popular is encryption parameters. As for how to encrypt parameters, that's beside the point. You can read the related posts by yourself, hoping to help you.