不要相信使用Parameter安全调用分页存贮过程会没有SQL注入

  
  

   
   
   
   　　　　DbParameter[] dbParams 
   
   =
   
    {
 Data.MakeInParam(
   
   "
   
   @PageIndex
   
   "
   
   , (DbType)SqlDbType.Int, 
   
   4
   
   , pageIndex),
 Data.MakeInParam(
   
   "
   
   @PageSize
   
   "
   
   , (DbType)SqlDbType.Int, 
   
   4
   
   , pageSize),
 Data.MakeInParam(
   
   "
   
   @Tables
   
   "
   
   , (DbType)SqlDbType.NVarChar, 
   
   1000
   
   , tableName),
 Data.MakeInParam(
   
   "
   
   @Fields
   
   "
   
   , (DbType)SqlDbType.NVarChar, 
   
   2000
   
   , fieldList),
 Data.MakeInParam(
   
   "
   
   @Where
   
   "
   
   , (DbType)SqlDbType.NVarChar, 
   
   2000
   
   , 
   
   where
   
   ),
 Data.MakeInParam(
   
   "
   
   @GroupBy
   
   "
   
   , (DbType)SqlDbType.NVarChar, 
   
   2000
   
   , groupBy),
 Data.MakeInParam(
   
   "
   
   @OrderBy
   
   "
   
   , (DbType)SqlDbType.NVarChar, 
   
   1000
   
   , orderBy),
 Data.MakeOutParam(
   
   "
   
   @ReturnCount
   
   "
   
   , (DbType)SqlDbType.Int, totalRecords),
 };
 list 
   
   =
   
    Data.GetDbDataReader(
   
   "
   
   getPagerROWOVER
   
   "
   
   , dbParams).ToList
   
   <
   
   TResult
   
   >
   
   ();