防止sql 注入的，简单参数化写法publicboolLogin(string_username,string_password) { using(SqlConnectionconn=newSqlConnection("server=.;uid=sa;pwd=123456;database=test")) { conn.Open(); stringsql="select1fromUserswhereUserName=@usernameandNumber=@number"; //参数化 us...