Question

我正在尝试构建一个使用SQL查询来帮助填充各种下拉列表并在gridviews中显示结果的Web表单，我现在遇到的问题是获取用户输入以替换SQL查询中的变量。

我的查询如下：

SELECT TOP 50 
    'Select' AS 'Select',
    id_ref AS 'Number',
    created_date AS 'Date Created',
    address 'Address', 
    category AS 'Category',
    borough 
FROM Events 
WHERE location_address LIKE '%%' 
    AND borough @borcond 
    AND admin_ref @stacond 
    AND id_ref @Numcond 
    AND category @cat 
    AND created_date @startDate 
    AND created_date @endDate 
    AND address LIKE @Addresscond 
ORDER BY id_todays_date DESC

我的C＃代码如下：

public void SQLQueryv2(
    string AddressSel, 
    string startDateSel, 
    string endDateSel, 
    string incidentSel, 
    string borsel, 
    string stasel, 
    string numsel)
{
    //this is filled in really
    SqlConnection Connection = new SqlConnection(
        "Data Source=;Initial Catalog=;User=;Password=;");
    string sqlquery = <<as above>>

    try
    {
        SqlCommand Command = new SqlCommand(sqlquery, Connection);
        Connection.Open();

        if (borsel == "Select Borough") 
        { 
            Command.Parameters.AddWithValue("@borcond", " = IS NOT NULL "); 
        } 
        else 
        { 
            Command.Parameters.AddWithValue("@borcond","= " + "'" + borsel + "'"); 
        }
        if (stasel == "Select Town") 
        { 
        Command.Parameters.AddWithValue("@stacond", " = IS NOT NULL "); 
        } 
        else 
        { 
            Command.Parameters.AddWithValue("@borcond","= "+ "'" + borsel + "'"); 
        }
        if (startDateSel == "") 
        { 
            Command.Parameters.AddWithValue("@startDate", " = IS NOT NULL"); 
        } 
        else 
        { 
            Command.Parameters.AddWithValue(
                "@startDate", 
                ">= CONVERT(datetime," + "'" + startDateSel + "'" + ",103)"); 
        }
        if (endDateSel == "") 
        { 
            Command.Parameters.AddWithValue("@endDate", " = IS NOT NULL"); 
        } 
        else 
        { 
            Command.Parameters.AddWithValue(
                "@endDate", 
                ">= CONVERT(datetime," + "'" + endDateSel + "'" + ",103)"); 
        }
        if (incidentSel == "Select Category") 
        { 
            Command.Parameters.AddWithValue(
                "@cat", 
                " in ('cat a','cat b','cat c')"); 
        } 
        else 
        {
            Command.Parameters.AddWithValue(
                "@cat",
                " AND category =" + "'" + incidentSel + "'"); 
        }
        if (AddressSel == "") 
        { 
            Command.Parameters.AddWithValue("@Addresscond", "%%"); 
        } 
        else 
        {
            Command.Parameters.AddWithValue("@Addresscond","%" + AddressSel + "%");
        }
        if (numsel == "") 
        { 
            Command.Parameters.AddWithValue("@Numcond", " = IS NOT NULL "); 
        } 
        else 
        { 
            Command.Parameters.AddWithValue("@Numcond", "= " + "'" + numsel + "'"); 
        }

         //use adapter to populate dataset...
        SqlDataAdapter DataAdapter = new SqlDataAdapter(sqlquery, Connection);
        DataTable DataTable = new DataTable();
        DataAdapter.SelectCommand = Command;
        DataAdapter.Fill(DataTable);

        //then bind dataset to the gridview
        GridView1.AutoGenerateColumns = true;
        GridView1.DataSource = DataTable;
        GridView1.DataBind();
        lblResults.Visible = true;
        lblResults.ForeColor = System.Drawing.Color.Green;
        lblResults.Text = "Your search has returned " 
            + Dataset.Tables[0].Select(
                "'Incident Number' IS NOT NULL").Length.ToString() 
            + " records.";
    }
    catch (Exception err)
    {
        lblResults.Visible = true;
        lblResults.ForeColor = System.Drawing.Color.Red;
        lblResults.Text = 
            "An error has occurred loading data into the table view. ";
        lblResults.Text += err.Message;
    }
}

运行时，Gridview不会填充，查询（在调查时）它仍然有变量，而不是'is nulls'或用户输入。

我认为IF语句的确如此，但我完全确定。我想我只需要另外一双眼睛，任何帮助将不胜感激。

更多信息：如果我取出sqlCommand位它与IF语句完美配合，我试图阻止人们使用恶意SQL查询。

Answer 1

juhar说。你对参数有错误的想法。它们是参数而不是文本替换。以下是有效查询的示例：

Select firstname, lastname from contacts
where ssn = @ssn

在您的代码中，您要说

Command.parameters.AddWithValue("@ssn","123-45-6789")

Answer 2

这实际上并不是使用参数的正确方法。您应该只为它们分配值，而不是添加比较运算符。这是一个如何修复＆＃34;的例子。您对@borcond参数

的查询

...
AND ((@borcond = 'Select Borough' AND borough IS NOT NULL) 
    OR borough = @borcond)
...

注意：您不需要使用IS NOT NULL

等号

用

替换if-else

Command.Parameters.AddWithValue("@borcond", borsel);

您需要对所有参数进行类似的更改。这里的技巧是基本上将你的if-else逻辑从代码移动到sql查询中。

此外，我认为您的查询中不需要location_address LIKE '%%'，因为它只匹配所有内容。

SqlCommand AddWithValue和if语句与gridview一起出现问题

2 个答案: