开发者

Can anybody help me for the syntax of select query?

i`m doing

string sql = "select * from publisher where title like "'"+tbproperty.text+";

but it`s not working!

开发者_JS百科

regards..


Use SqlParameter:

SqlCommand cmd = new SqlCommand("select * from publisher where title like @title");
cmd.Parameters.AddWithValue("@title", tbProperty.Text);

If you need to add more to the parameter, then do the following (E.g.: output parameter):

SqlParameter param = new SqlParameter("@param ", SqlDbType.NVarChar, 250) { Direction = ParameterDirection.Output };
cmd.Parameters.Add(param);

This means you don't need to build the string per se and stops SQL injection.


With LIKE, if you expect begin/ends matches you need some wildcards such as '%', and I'm assuming that the user isn't adding those; but - important: don't concatenate user input. Ever; you want something like:

sql = "select * from publisher where title like @arg";

With @arg defined as a parameter, with value something like:

cmd.Parameters.AddWithValue("@arg", "%" + tbproperty.text + "%");


Correction..

string sql = "select * from publisher where title like '" + tbproperty.text + "'";
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜