如何在ASP.NET中使用参数化SQL查询

问题描述

我正在尝试使用以下查询

Hi,
I am trying to use the following query

Dim sqlQry As String = "SELECT * FROM tblTest where Name=@NM and Rank=@RN"
    
Then I fill my dataadapter by
Dim dAdt As New SqlDataAdapter(sqlQry, conStr)

但是不知道在哪里将我设置的参数放在where子句之后.

谢谢

But donot know where to put the parameters that I have set after where clause.

Thanks

推荐答案

Dim databaseConnection As New SqlConnection
Dim queryCommand As New SqlCommand

databaseConnection.ConnectionString = conStr
databaseConnection.Open
queryCommand.CommandText = "SELECT * FROM tblTest where Name=@NM and Rank=@RN"
queryCommand.Parameters.AddWithValue("@NM", someNMvariable)
queryCommand.Parameters.AddWithValue("@RN", someRNvariable)
queryCommand.Connection = databaseConnection
Dim dAdt As New SqlDataAdapter(queryCommand)
...
databaseConnection.Close

这篇关于如何在ASP.NET中使用参数化SQL查询的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！