如何使用ASP.NET从数据库中删除某一行 [英] How do I delete a certain row from database using ASP.NET
问题描述
我想从数据库中查看列表后删除某一行。如何使用asp：Gridview删除它？
代码块添加 - OriginalGriff [/ edit]
我尝试了什么：
i want to delete a certain row after i view the list from database. how can i delete it using asp:Gridview?
[edit]Code block added - OriginalGriff[/edit]
What I have tried:
<center>
<div>
<center>
<asp:Image ID="p1" ImageUrl="p1.png" runat="server" Width="200px">
</center>
<br>
<center>
<asp:Label ID="Label1" runat="server" Text="Malaysian Communications and Multimedia Commisions" Font-Bold="True" Font-Size="XX-Large" ForeColor="#0099FF">
</center>
<br>
<center>
<asp:Label ID="Label2" runat="server" Text="Propose New System" Font-Bold="True" Font-Size="XX-Large" ForeColor="#0099FF">
</center>
<br>
</div>
<br>
<br>
<div>
<asp:TextBox ID="TextBox1" runat="server"><asp:Button ID="view" runat="server" Text="View" Width="86px" OnClick="view_Click">
<br>
<asp:Label ID="Label3" runat="server" Text="Please enter your ID to view list of system" Font-Size="Small" ForeColor="Red">
<br>
<br>
<asp:Button ID="new" runat="server" Text="Add Item" OnClick="new_Click">
</div>
<br>
<center>
<asp:GridView ID="GridView1" runat="server" Width = "1200px" Font-Names = "Arial" Font-Size = "11pt" AlternatingRowStyle-BackColor = "#87dcf2" HeaderStyle-BackColor = "#f29a1f">
<columns>
<asp:templatefield>
<edititemtemplate>
<asp:Button ID="ButtonUpdate" runat="server" CommandName="Update" Text="Update" />
<asp:Button ID="ButtonCancel" runat="server" CommandName="Cancel" Text="Cancel" />
<itemtemplate>
<asp:Button ID="ButtonEdit" runat="server" CommandName="Edit" Text="Edit" />
<asp:Button ID="ButtonDelete" runat="server" CommandName="Delete" Text="Delete" />
================================================= ======
=======================================================
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Text;
using System.Data.SqlClient;
using System.Xml.Linq;
using System.Data;
using System.Web.UI.HtmlControls;
using System.Web.Configuration;
using System.Configuration;
public partial class home : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
if (!Page.IsPostBack)
{
if (!IsPostBack)
{
//BindUserDetails();
}
}
}
protected void view_Click(object sender, EventArgs e)
{
SqlConnection myConn = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["dbconnection2"].ConnectionString);
try
{
myConn.Open();
SqlDataAdapter sda = new SqlDataAdapter("select department,Description,Objective from tb_form4 where id='" + TextBox1.Text + "'", myConn);
DataSet ds = new DataSet();
sda.Fill(ds);
GridView1.DataSource = ds;
GridView1.DataBind();
}
catch (SqlException ex)
{
}
finally
{
// Close data reader object and database connection
if (myConn.State == ConnectionState.Open)
{
myConn.Close();
}
}
}
protected void new_Click(object sender, EventArgs e)
{
Response.Redirect("Default.aspx");
}
}
推荐答案
对于初学者来说，永远不要那样做！永远不要连接字符串来构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。改为使用参数化查询。
连接字符串时会导致问题，因为SQL会收到如下命令：
For starters, never do that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
When you concatenate strings, you cause problems because SQL receives commands like:
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'就SQL而言，用户添加的引号会终止字符串，并且您会遇到问题。但情况可能更糟。如果我来并改为输入：x'; DROP TABLE MyTable; - 然后SQL收到一个非常不同的命令：
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'哪个SQL看作三个单独的命令：
Which SQL sees as three separate commands:
SELECT * FROM MyTable WHERE StreetAddress = 'x';完全有效的SELECT
A perfectly valid SELECT
DROP TABLE MyTable;完全有效的删除表格通讯和
A perfectly valid "delete the table" command
--'其他一切都是评论。
所以它确实：选择任何匹配的行，从数据库中删除表，并忽略其他任何内容。
所以总是使用参数化查询！或者准备好经常从备份中恢复数据库。你定期做备份，不是吗？
在网站上？世界上任何地方的人都可以做他喜欢的事情吗？这只是在寻找麻烦！
当你在整个应用程序中修复它 - 并且作为一个非常高的优先级 - 看看添加代码来执行SQL DELETE：< a href =https://www.w3schools.com/sql/sql_delete.asp> W3Schools：SQL DELETE语句 [ ^ ]，但在修复SQL注入问题之前，请不要考虑这个问题！
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.
So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?
And on a website? Where anyone from anywhere in the world can do exactly what he likes? That's just asking for trouble!
When you have fixed that throughout your app - and as a very high priority - look at adding the code to do an SQL DELETE: W3Schools: SQL DELETE Statement[^], but don't even think about that until you have fixed the SQL Injection problems!
这篇关于如何使用ASP.NET从数据库中删除某一行的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
