How do I prevent my SQL statements from SQL injection when using CLR/C++ with multiple variables?
问题 I am having a major problem where I do not know how to prevent SQL injection when writing SQL statements in CLR/C++ Below is the code String^ sqlstr = "SELECT * FROM "; sqlstr += tableName + " WHERE " + field + " = " + fieldEntity; I need to be able to input correct SQL Injection preventions to this statement. Background code class database { protected: string fieldEntity; string tableName; string field; ... ____ OleDbDataReader^ openData(String^ fieldEntity, String^ field, String^ tableName)