Question

我在SQL命令中遇到错误，我试图从SQL Server数据库中检索值。如标题中所述，它在浏览器中显示错误。如果我删除括号，则会在AND运算符

中显示错误

string jdate = (string)Session["jdate"];
string clas = (string)Session["class"];
string scode = (string)Session["scode"];
string dcode = (string)Session["dcode"];
cn = new SqlConnection(ConfigurationManager.ConnectionStrings["dummyConnectionString"].ToString());

// error shows up on this line 
string slct = "SELECT Route.Route_Source, Route.Route_Destination, Flight.Flight_Name, Schedule.Depart_Time, Schedule.Arr_Time, Schedule.Route_rate_Ad , Seats." + jdate + 
              "Schedule.Sch_id FROM Schedule INNER JOIN Flight ON Schedule.Flight_Id = Flight.Flight_id INNER JOIN Route ON Schedule.Route_id = Route.Route_id INNER JOIN Seats ON Seats.Sch_id = Schedule.Sch_id WHERE (Route.Route_Source =" + scode + ") AND (Route.Route_Destination =" + dcode + ") AND (Seats.Class=" + clas + ") ORDER BY Schedule.Depart_Time, Schedule.Arr_Time, Flight.Flight_Name";

cn.Open();

SqlDataAdapter da = new SqlDataAdapter(slct, cn);
DataSet ds = new DataSet();
da.Fill(ds);

SearchView.DataSource = ds;
SearchView.DataBind();

Answer 1

您应该使用参数化查询这将允许更易理解的查询文本，避免简单的语法错误（就像第一行（jdate）末尾缺少的逗号），
避免使用包含引号或小数分隔符的字符串进行Sql注入和解析问题

string slct = @"SELECT Route.Route_Source, Route.Route_Destination, 
               Flight.Flight_Name, Schedule.Depart_Time, Schedule.Arr_Time, 
               Schedule.Route_rate_Ad, Seats." + jdate + ", Schedule.Sch_id " +
               @"FROM Schedule INNER JOIN Flight ON Schedule.Flight_Id = Flight.Flight_id 
                         INNER JOIN Route ON Schedule.Route_id = Route.Route_id 
                         INNER JOIN Seats ON Seats.Sch_id = Schedule.Sch_id 
                 WHERE (Route.Route_Source = @scode) 
                    AND (Route.Route_Destination =@dcode) 
                    AND (Seats.Class=@class) 
                 ORDER BY Schedule.Depart_Time, Schedule.Arr_Time, Flight.Flight_Name";

cn.Open();
SqlCommand cmd = new SqlCommand(slct, cn);
cmd.Parameters.AddWithValue("@scode", scode);
cmd.Parameters.AddWithValue("@dcode", dcode);
cmd.Parameters.AddWithValue("@class", clas);
SqlDataAdapter da = new SqlDataAdapter(cmd);
DataSet ds = new DataSet();
da.Fill(ds);

System.Data.SqlClient.SqlException：'）'附近的语法不正确

1 个答案: