delphi中的列名无效 [英] Invalid column name in delphi

问题描述

我对此代码有疑问，我不知道如何修复它。



我尝试了什么： < br $> b $ b

I have a problem with this code and I don't know how to fix it.

What I have tried:

ADODataSet1.Close;
  if ListFiltr1.ItemIndex = 0 then
    ADODataSet1.CommandText :=
      'select [EmployeeID],LastName,FirstName,Title,City from Employees where '
      + ListeChampTxt.Items[ListeChampTxt.ItemIndex] +'= "' + TxtCherche.text +
      '" order by ' + ListTrie.Items[ListTrie.ItemIndex] + TxtTrie;
   ADODataSet1.Active := True;
   ADODataSet1.Requery();
end;

推荐答案

从不这样做开始！永远不要连接字符串来构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。改为使用参数化查询。



然后，使用调试器找出你正在生成的字符串：我怀疑这一点：

Start by not doing that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

Then, use the debugger to find out exactly what string you are generating: I'd suspect this bit:

... order by ' + ListTrie.Items[ListTrie.ItemIndex] + TxtTrie ...

由于您未关闭引号，我很确定开放引用不是你想要的，但是因为这一切都取决于你所在领域的数据我们无法分辨 - 你也不能不使用调试器来找出究竟是什么发送到DB。

Since you don't close the quotes, and I'm pretty sure the open quote isn't what you wanted anyway, but since it all depends on the data in your fields we can't tell - and neither can you without using the debugger to find out exactly what is being sent to the DB.

这篇关于delphi中的列名无效的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！