c# - 在参数化的查询中重写没有前缀 N 和没有单引号的查询是否有区别

Question

我之前的查询是 name=N'hook' 然后改为 name=@name 这些更改是为了避免 sql 注入，我认为在新代码中缺少单引号和前缀 N，但我没有把握。

//OLD CODE with prefix N, the param is wrapped in single quotes
var schemaName = "";
...
var command = new SqlCommand("SELECT schema_id FROM sys.schemas WHERE name = N'" + schemaName + "')";

//OLD CODE without prefix N, the param is wrapped in single quotes
var schemaName = "";
...
var command = new SqlCommand("SELECT schema_id FROM sys.schemas WHERE name = '" + schemaName + "')";


//NEW CODE
var schemaName = "";
...
var command = new SqlCommand("SELECT schema_id FROM sys.schemas WHERE name = @schemaName");
    command.Parameters.Add(new SqlParameter("@schemaName", schemaName));

标签： c#asp.net.netc#-6.0