无法阻止SQL注入错误

我终于明白了。这不仅仅是我用来执行ExecuteScalar方法的代码，它主要是执行类的上游代码。它是调用代码的所有东西。也就是说，有人请看看是否执行我的SQL类的代码有错误。我还是不能通过扫描。首先，我将向您展示调用我的代码的两个示例，然后是调用代码，最后是执行代码，这是我在上一篇文章中制定并显示的。

三个参数的调用代码:

public bool isTamAsp(int aspKey, int fy, string accountCode)
{
    MyParam myParam;
    string sqlQuery = "select isTamMacom = count(macom_key) FROM hier_fy " +
        "WHERE hier_key = @aspKey AND fy = @fy  AND @accountCode NOT IN (3,4,7,8) AND macom_key IN (select hier_key from lkup_e581_MacomThatRequireTAM) AND is_visible = 1 AND is_active = 1";
    QueryContainer Instance = new QueryContainer(sqlQuery);
    myParam = new MyParam();
    myParam.SqlParam = new SqlParameter("@aspKey", Instance.AddParameterType(_DbTypes.Int));
    myParam.SqlParam.Value = aspKey;
    Instance.parameterList.Add(myParam);
    myParam = new MyParam();
    myParam.SqlParam = new SqlParameter("@fy", Instance.AddParameterType(_DbTypes.Int));
    myParam.SqlParam.Value = fy;
    Instance.parameterList.Add(myParam);
    myParam = new MyParam();
    myParam.SqlParam = new SqlParameter("@accountCode", Instance.AddParameterType(_DbTypes._string));
    myParam.SqlParam.Value = accountCode;
    Instance.parameterList.Add(myParam);
    if (Convert.ToInt32(ExecuteScaler(Instance)) < 1)
        return false;
    return true;
}

不带参数的调用代码:

public long GetMarinesUploadNextUploadKey()
{
    string query = "SELECT MAX(upload_key) FROM temp_auth_usmc_upload";
    QueryContainer Instance = new QueryContainer(query);
    string result = Convert.ToString(ExecuteScaler(Instance));
    if (string.IsNullOrEmpty(result))
        return 1;
    else
        return Convert.ToInt64(result) + 1;
} 

代码调用我之前的代码，有三个参数:

public bool isTamAsp(int aspKey, int fy, string accountCode)
{
    return e581provider.isTamAsp(aspKey, fy, accountCode);
}

方法调用SQL执行我的代码:

DbCommand command = _provider.CreateCommand();
command.Connection = _connection;
{
    command.CommandText = Instance.Query;
    command.CommandType = CommandType.Text;
    if (Instance.parameterList.Count > 0)
    {
        foreach (var p in Instance.parameterList)
        {
            command.Parameters.Add(p.SqlParam);
        }
    }
    if (_useTransaction) { command.Transaction = _transaction; }
    try
    {
        returnValue = command.ExecuteScalar();
    }

My Class包含SQL字符串和cmd参数List

public enum _DbTypes
{
    Int = 1, _string = 2, _long = 3, _bool = 4, _DateTime = 5,
    _decimal = 6, _float = 7, _short = 8, _bite = 9
} 
public class MyParam
{
    public SqlParameter SqlParam { get; set; }
}
/// <summary>
/// Summary description for QueryContainer SGH
/// </summary>
public class QueryContainer
{
    string _query;
    public List<MyParam> parameterList = new List<MyParam>();
    public QueryContainer(string query) { _query = query; }
    public SqlDbType AddParameterType(_DbTypes id)
    {
        switch (id)
        {
            case _DbTypes.Int:
                return (SqlDbType)Enum.Parse(typeof(SqlDbType), "int", true);
            case _DbTypes._string:
                return (SqlDbType)Enum.Parse(typeof(SqlDbType), "NVarChar", true);
            case _DbTypes._long:
                return (SqlDbType)Enum.Parse(typeof(SqlDbType), "SqlDbType.BigInt", true);
            case _DbTypes._bool:
                return (SqlDbType)Enum.Parse(typeof(SqlDbType), "SqlDbType.Bit", true);
        }
        return SqlDbType.VarChar;
    }
    public string Query
    {
        get
        {
            return _query;
        }
        set { _query = value; }
    }
}

IEnumerable<T> GetData<T>(string query, IEnumerable<Sqlparameter> parameters)