asp.net - 使用 SQL 注入绕过身份验证

Question

进行安全扫描时，此错误显示为高：

Remediation Tasks: Filter out hazardous characters from user input ?
for parameter (Parameter = txtPassword),(Parameter = btnLogin) and (Parameter = txtName)

所有这些都在如下代码中使用：

With sqlcomm.Parameters
   .AddWithValue("@userName", DataEncryption.DataEncryption.EncryptString(LCase(txtName.Text), "OmSs23re24&&UsErNa(Me"))
   .AddWithValue("@Pass", DataEncryption.DataEncryption.EncryptString(txtPassword.Text, "OmSP12aSsW%%8oR*d"))
End With

If (Session("Admin") Is Nothing) Then
    If txtName.Text = txtPassword.Text Or forgotpassCls.GetUserLoginFlag(Session("custid").ToString()) Then
       If ForceChange = "True" Then
            Response.Redirect("ChangePassword.aspx", True)
       Else
            Response.Redirect(DefaultURL, True)
       End If
    End If
 Else '' if the user is an admin
     If txtName.Text = txtPassword.Text Or forgotpassCls.GetUserLoginFlag(Session("Admin").ToString()) Then
         If ForceChange = "True" Then
              Response.Redirect("ChangePassword.aspx", True)
          Else
               Response.Redirect(DefaultURL, True)
          End If
      End If
 End If

我能做些什么？