where子句中的动态值

Question

我想根据打开窗体的用户选择照片。

如果我在where子句中加上一个数字，“where id = 36”，它只显示ID 34的照片（静态）。我怎样才能让它变得动态？每个用户都有自己的照片，因此应该加载。代码如下。

 $("#grid").kendoGrid({
                    dataSource: {
                        type: "odata",
                        transport: {
                            read: "https://demos.telerik.com/kendo-ui/service/Northwind.svc/Orders"
                        },
                        schema: {
                            model: {
                                fields: {
                                    OrderID: { type: "number" },
                                    Freight: { type: "number" },
                                    ShipName: { type: "string" },
                                    OrderDate: { type: "date" },
                                    ShipCity: { type: "string" }
                                }
                            }
                        },
                        pageSize: 20,
                        serverPaging: true,
                        serverFiltering: true,
                        serverSorting: true
                    },
                    height: 550,
                    filterable: true,
                    sortable: true,
                    pageable: true,
                    columns: [{
                            field:"OrderID",
                            filterable: false
                        },
                        "Freight",
                        {
                            field: "OrderDate",
                            title: "Order Date",
                            format: "{0:MM/dd/yyyy}"
                        }, {
                            field: "ShipName",
                            title: "Ship Name"
                        }, {
                            field: "ShipCity",
                            title: "Ship City"
                        }
                    ]
                });

Answer 1

您应该使用Parameter对象来添加它，而不是动态创建SQL语句。它通常更安全，并且在性能方面没有真正的惩罚

var con = new SqlConnection();
var cmd = new SqlCommand("select profilepic from users where id=@id", con);
cmd.Parameters.AddWithValue("@id", 36);
var pic = cmd.ExecuteScalar();