为什么不在SQL中工作

问题描述

string sql2 =从[Repeat of dest]中选择[A]，[重复次数]，其中[A]喜欢'+ textBox4.Text +';

使用（系统.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand（sql1，conn2））

{

conn2.Open（）;



System.Data.SqlClient.SqlDataReader reader = null;



reader = cmd.ExecuteReader（）;

while（reader.Read（））

{

textBox4.Text =（reader [A]）。ToString（）;

}}



我尝试过：



为什么不工作命令sql ??

请帮帮我？

string sql2 = "select [A],[number of dups] from [Repeat of dest] where [A] like '" + textBox4.Text + "' ";
using (System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand(sql1, conn2))
{
conn2.Open();

System.Data.SqlClient.SqlDataReader reader = null;

reader = cmd.ExecuteReader();
while (reader.Read())
{
textBox4.Text = (reader["A"]).ToString();
}}

What I have tried:

why not work command sql??
please help me?

推荐答案

string sql2 = "SELECT [A],[number of dups] FROM [Repeat of dest] WHERE [A] LIKE '%' + @STR + '%'";
using (System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand(sql2, conn2))
    {
    conn2.Open();
    cmd.Parameters.AddWithValue("@STR",  textBox4.Text);
    ...

并问自己一个问题：如果你要去问问题，你有什么问题吗？不理会给你的建议？这不是我第一次告诉你有关SQL Inject和参数化查询的问题，或类似的问题 - 但你显然没有倾听或思考你被告知的内容。请开始同时...

And ask yourself a question: Is there any point in you asking questions if you are just going to ignore the advice you are given? This is not the first time I've told you about SQL Inject and parameterized queries, or about a similar problem - but you clearly aren't listening or thinking about what you have been told. Please start doing both...

这篇关于为什么不在SQL中工作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！