Gets the string that is used to prefix a parameter placeholder in a parameterized SQL query.
获取用作参数化 SQL 查询中的参数占位符前缀的字符串。
The parameterized SQL statement yields metadata which does not match the main SQL statement.
参数化 SQL 语句生成的元数据与主 SQL 语句不匹配。
Review the query string passed to {0} in {1} for possible SQL the string is composed using any user input, consider using a stored procedure or a parameterized SQL query instead of building the query with string concatenations.
You can also map the enumerator collection value in a Foreach Loop container to a variable, and if an Execute SQL task uses a parameterized SQL statement, you can map the parameters for the statement to variables.
A SQL command string built from user input is vulnerable to SQL injection attacks. Microsoft SQL Server and other database servers support stored procedures and parameterized SQL queries, which reduce the risk of injection attacks.
通过用户输入生成的 SQL 命令字符串容易受到 SQL 注入式攻击。Microsoft SQL Server 和其他数据库服务器支持存储过程和参数化 SQL 查询,这将降低受到注入式攻击的风险。
Potentially sensitive or inappropriate content
Examples are used only to help you translate the word or expression searched in various contexts. They are not selected or validated by us and can contain inappropriate terms or ideas. Please report examples to be edited or not to be displayed. Potentially sensitive, inappropriate or colloquial translations are usually marked in red or in orange.