日期时间比较问题 [英] Datetime comparision issue

问题描述

我有一个ms访问数据库，其日期时间列'已解决'....在mc＃应用程序中我有两个datetimepickers .... datetimepicker1是'从日期'并且datetimepicker2是'到目前为止'



我的sql查询是

string query =select count（*）from fact events [resolve on]>'+ dateTimePicker1.Value + '和[已解决]<'+ dateTimePicker2.Value +';



我收到此错误>>标准表达式中的数据类型不匹配



ms访问列是数据时间格式长
datetimepickers格式是长日期



我尝试过：

i have a ms access db with a datetime column 'resolved on' ....In m c# application i have two datetimepickers.... datetimepicker1 is 'from date' and datetimepicker2 is 'to date'

my sql query is
string query = "select count(*) from incidents where [resolved on] > '" + dateTimePicker1.Value + "' and [resolved on] < '" + dateTimePicker2.Value + "' ";

im getting this error >> data type mismatch in criteria expresion

ms access column is datatime format long
datetimepickers format is long date

What I have tried:

string query = "select count(*) from incidents where [resolved on] > '" + dateTimePicker1.Value + "' and [resolved on] < '" + dateTimePicker2.Value + "' ";

推荐答案

不是那样的！永远不要连接字符串来构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。改为使用参数化查询。



连接字符串时会导致问题，因为SQL会收到如下命令：

Not like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

就SQL而言，用户添加的引号会终止字符串，并且您会遇到问题。但情况可能更糟。如果我来并改为输入：x'; DROP TABLE MyTable; - 然后SQL收到一个非常不同的命令：

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

哪个SQL看作三个单独的命令：

Which SQL sees as three separate commands:

SELECT * FROM MyTable WHERE StreetAddress = 'x';

完全有效的SELECT

A perfectly valid SELECT

DROP TABLE MyTable;

完全有效的删除表格通讯和

A perfectly valid "delete the table" command

--'

其他一切都是评论。

所以它确实：选择任何匹配的行，从数据库中删除表，并忽略其他任何内容。



所以总是使用参数化查询！或者准备好经常从备份中恢复数据库。你定期进行备份，不是吗？



在这种情况下，你不会遇到SQL注入问题，但是你需要紧急检查代码中的其他位置以确保已修复所有这些内容。留一个，你迟早会遇到问题。



当你参数化后，问题可能会消失 - 但如果没有，那么你需要检查你的数据库设计，并确保Resolved On列设置为DATE，DATETIME或DATETIME2 - 如果它是VARCHAR或NVARCHAR则它将永远不会正常工作，因为字符串比较是逐字符进行的，结果是整个比较的结果是第一个不同字符对的结果。这对于日期来说没用，因为就像数字一样，它会导致这种排序：

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

In this case, you won't have an SQL Injection problem, but you need as a matter of urgency to check everywhere else in your code to make sure that you have fixed all of them. Leave one, and you will get problems sooner or later.

When you have it parameterized, the problem may go away - but if it doesn't then you need to check your DB design, and make sure that the "Resolved On" column is set as DATE, DATETIME, or DATETIME2 - if it's VARCHAR or NVARCHAR then it will never work properly, as string comparisons are conducted character-by character, with the result of the whole comparison being the result of the first different character pair. That's useless for dates, because just as with numbers it leads to this sort order:

1
10
11
...
19
2
20
21
...

这对你没有任何用处。

处理日期和时间的唯一合理方法是在C＃和Access中使用DateTime数据类型。

All Access看到的是一个字符串，它无法知道它是一个日期及其含义。

为了比较这样一个字符串，你必须将部分重新排序为'yyyymmdd'，并将其转换为一个月的数字。这适用于您想要比较的每个日期。

The only sensible way to handle dates and times is to use the DateTime data type both in C# and Access.
All Access sees is a string, it have no way to know that it is a date and what it means.
In order to compare such a string, you have to reorder parts to 'yyyymmdd' with a month transcoding to its number. And this for every date you want to compare.

这篇关于日期时间比较问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！