如何调用null值而不是date1和date2之间 [英] How to call null value and not between date1 and date2

问题描述

请帮帮我。

我试图调用空值和休眠交易，这意味着不在date1和date2之间，但我的水晶报告显示空值。

我是使用vb.net 2008和水晶报告。



我尝试过：



dap =新OleDb.OleDbDataAdapter（SELECT * FROM tblRevenueRegister WHERE [Dte] NOT BETWEEN＃& dtpFromDate.Value&＃AND＃& dtpToDate.Value&＃AND Amt IS NULL Order By RevID，Cnn）

Please help me.
I have tried to call null value and dormant transactions which mean not between date1 and date2 but my crystal report show empty value.
I am using vb.net 2008 and crystal report.

What I have tried:

dap = New OleDb.OleDbDataAdapter("SELECT * FROM tblRevenueRegister WHERE [Dte] NOT BETWEEN #" & dtpFromDate.Value & "# AND #" & dtpToDate.Value & "# AND Amt IS NULL Order By RevID", Cnn)

推荐答案

不要这样做：永远不要连接字符串来构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。改为使用参数化查询。



连接字符串时会导致问题，因为SQL会收到如下命令：

Don't do it like that: Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

就SQL而言，用户添加的引号会终止字符串，并且您会遇到问题。但情况可能更糟。如果我来并改为输入：x'; DROP TABLE MyTable; - 然后SQL收到一个非常不同的命令：

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

哪个SQL看作三个单独的命令：

Which SQL sees as three separate commands:

SELECT * FROM MyTable WHERE StreetAddress = 'x';

完全有效的SELECT

A perfectly valid SELECT

DROP TABLE MyTable;

完全有效的删除表格通讯和

A perfectly valid "delete the table" command

--'

其他一切都是评论。

所以它确实：选择任何匹配的行，从数据库中删除表，并忽略其他任何内容。



所以总是使用参数化查询！或者准备好经常从备份中恢复数据库。你定期做备份，不是吗？



在这种情况下，它不会引起注射问题，但是会有其他问题，因为日期会是转换为字符串，并且必须由数据库引擎转换回DATETIME值，这可能会出错 - 假设您的 Dte 列是DATE或DATETIME列而是比NVARCHAR。如果它是NVARCHAR，那么它将失败，因为字符串逐字符比较，比较的结果由第一个不同的字符对确定。



因此修复整个连接您的整个应用，然后再次测试。如果仍然失败，我们需要查看您的表定义和样本数据。

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

In this case, it won't cause injection problems, but it will have other problems because the date will be converted to a string and will have to be converted back to a DATETIME value by the DB Engine, which can go wrong - assuming that your Dte column is a DATE or DATETIME column rather than NVARCHAR. If it's NVARCHAR then it will fail because strings are compared character by character with the result of the comparison being determined by the first different character pair.

So fix the concatenation throughout your entire app, and then test this again. If it still fails we will need to see your table definition and sample data.

这篇关于如何调用null值而不是date1和date2之间的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！