使用开放输入清理数据库查询

Question

我正在尝试将学生考试查询结果与教师给出默认答案查询结果进行比较。到目前为止，我已经创建了这个控制器：

[HttpPost]
public async Task<IActionResult> Search(string query)
{
        if (!String.IsNullOrEmpty(query))
        {
            if (query.ToLower().Contains("drop table") || query.ToLower().Contains("create table") || query.ToLower().Contains("update") || query.ToLower().Contains("delete") || query.ToLower().Contains("drop database"))
            {
                ViewBag.warning = "You are a bad boy";
                return View();
            }

            var conn = _context.Database.GetDbConnection();
            int row = 0;

            var columns = new List<string>();
            var columndata = new List<string>();

            try
            {
                await conn.OpenAsync();

                using (var command = conn.CreateCommand())
                {
                    command.CommandText = query;
                    DbDataReader reader = await command.ExecuteReaderAsync();

                    if (reader.HasRows)
                    {
                        columns = Enumerable.Range(0, reader.FieldCount).Select(reader.GetName).ToList();
                        ViewBag.columncount = reader.FieldCount;

                        while (await reader.ReadAsync())
                        {
                            for (int i = 0; i < reader.FieldCount; i++)
                            {
                                columndata.Add(reader.GetValue(i).ToString());
                            }
                            row++;
                        }
                    }

                    reader.Dispose();
                }
            }
            finally
            {
                conn.Close();
            }

            ViewBag.queryData = columndata;
            ViewData["RowsAffected"] = row;

            return View(columns);
        }
        else
        {
            return NotFound();
        }
}

导致Search.cshtml

@{
ViewData["Title"] = "View";
}


<textarea placeholder="@ViewBag.warning">@ViewBag.warning</textarea>

<p>@ViewBag.warning</p>
@if (ViewData["RowsAffected"] != null)
{
<p>
    Number of rows : @ViewData["RowsAffected"]
</p>
}
@if (ViewBag.columncount != null)
{
int count = ViewBag.columncount;
int count2 = count - 1;
int index = 0;
int i = 0;`
<table class="table">
    <thead>
        <tr>
            @foreach (var item in Model)
            {
                <th>@item</th>
            }
        </tr>

    </thead>
    <tbody>
        @while (i <= count2)
        {
            <tr>
                @while (index < ViewBag.queryData.Count && i <= count2)
                {
                    <td>
                        @ViewBag.queryData[index]
                    </td>
                    index++;
                    i++;
                }
                @{ count2 += count;
                }
                @if (index >= ViewBag.queryData.Count)
                {

                    break;
                }
            </tr>
        }
    </tbody>
</table>
}

如何在参加考试时更好地控制用户（学生）的输入？

此时我无法确定如何将查询结果与任何其他结果进行比较。我应该使用sql而不是比较结果吗？