防注入

string sql = "insert into 表名 values(@字段)";
SqlParameter s = new SqlParameter("@字段", FileByteArray);
SqlCommand cmd = new SqlCommand(sql, conn);//conn为SqlConnection实例对象
cmd.Parameters.Add(s);
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();