C++ とデータベースを操作するにはどうすればよいですか?

#include <windows.h>
#include <sql.h>

int main(int argc, char* argv[]) {
    SQLHENV env;
    SQLHDBC dbc;
    SQLHSTMT stmt;
    SQLRETURN retCode;
    char buff[512];

    /*声明句柄并打开ODBC环境*/
    SQLAllocHandle(SQL_HANDLE_ENV, SQL_NULL_HANDLE, &env);
    SQLSetEnvAttr(env, SQL_ATTR_ODBC_VERSION, (void*)SQL_OV_ODBC3, 0);
    SQLAllocHandle(SQL_HANDLE_DBC, env, &dbc);

    /*连接数据库*/
    SQLConnect(dbc, "database_name", SQL_NTS, "user_name", SQL_NTS, "password", SQL_NTS);

    /*执行SQL语句*/
    SQLAllocHandle(SQL_HANDLE_STMT, dbc, &stmt);
    SQLExecDirect(stmt, "SELECT * FROM table_name", SQL_NTS);

    /*处理结果*/
    while(SQLFetch(stmt) == SQL_SUCCESS) {
        SQLGetData(stmt, 1, SQL_C_CHAR, buff, sizeof(buff), NULL);
        cout << "Column1 = " << buff << endl;
    }

    /*释放资源*/
    SQLFreeHandle(SQL_HANDLE_ENV, env);
    SQLFreeHandle(SQL_HANDLE_DBC, dbc);
    SQLFreeHandle(SQL_HANDLE_STMT, stmt);

    return 0;
}

SQLAllocHandle(SQL_HANDLE_STMT, dbc, &stmt);

retCode = SQLExecDirect(stmt, (SQLCHAR*)"INSERT INTO table_name (Column1, Column2) VALUES ('value1', 'value2')", SQL_NTS);

SQLAllocHandle(SQL_HANDLE_STMT, dbc, &stmt);

retCode = SQLExecDirect(stmt, (SQLCHAR*)"SELECT * FROM table_name", SQL_NTS);

while(SQLFetch(stmt) == SQL_SUCCESS) {
    SQLGetData(stmt, 1, SQL_C_CHAR, buff, sizeof(buff), NULL);
    cout << "Column1 = " << buff << endl;
}

SQLAllocHandle(SQL_HANDLE_STMT, dbc, &stmt);

retCode = SQLExecDirect(stmt, (SQLCHAR*)"UPDATE table_name SET Column1='value3' WHERE Column2='value2'",
SQL_NTS);

SQLAllocHandle(SQL_HANDLE_STMT, dbc, &stmt);

retCode = SQLExecDirect(stmt, (SQLCHAR*)"DELETE FROM table_name WHERE Column2='value2'",
SQL_NTS);

/*保证输入合法*/
string id = "123";
string name = "Tom' OR '1'='1";   /*SQL注入代码*/

/*通过参数化进行查询*/
SQLCHAR query[255];
sprintf((char*)query, "SELECT * FROM table_name WHERE id=? AND name=?");   /*使用占位符*/

SQLAllocHandle(SQL_HANDLE_STMT, dbc, &stmt);
SQLPrepare(stmt, query, SQL_NTS);

SQLBindParameter(stmt, 1, SQL_PARAM_INPUT, SQL_C_CHAR, SQL_CHAR, id.size(), 0, (void*)id.c_str(), 0, NULL);
SQLBindParameter(stmt, 2, SQL_PARAM_INPUT, SQL_C_CHAR, SQL_CHAR, name.size(), 0, (void*)name.c_str(), 0, NULL);

retCode = SQLExecute(stmt);