[已解决]使用数据列表循环链接按钮和标签 [英] [Solved]Looping Linkbutton and Label using Data List

问题描述

我正在尝试使用数据列表和项目模板搜索数据库。



我只想在一个链接按钮和一行一行中从数据库循环数据。我是新手。

Hi,

I am trying to search the database using Data List and Item Template.

I just want to loop the data's from database in a linkbutton and a lable row by row.I am new to this.

DataSet ds = new DataSet();
DataTable dt = new DataTable();
dt.Columns.Add(new DataColumn("Description", typeof(string)));
dt.Columns.Add(new DataColumn("Auctionno", typeof(string)));
dt.Columns.Add(new DataColumn("Location", typeof(string)));
SqlCommand cmd = new SqlCommand("select * from Auction_Upload where Keyword = '" + TextBox1.Text + "'", con);
con.Open();
SqlDataReader dr = cmd.ExecuteReader();
if(dr.Read())
{
DataRow dc = dt.NewRow();
dc["Description"] = dr["Description"].ToString();
dc["Auctionno"] = dr["Auctionno"].ToString();
dc["Location"] = dr["Location"].ToString();
dt.Rows.Add(dc);
}
DataList1.DataSource = dt;
DataList1.DataBind();

请帮帮我这个

提前致谢

Please Help me in this
Thanks in advance

推荐答案

请查看Richard Deeming对问题的评论。



你的方法从一开始就是错误的。通过串联从UI获取的字符串组成的查询。不仅重复的字符串连接是低效的（因为字符串是不可变的;我是否必须解释为什么它会使重复连接变坏？），但是有更重要的问题：它打开了通向良好的大门已知的漏洞称为 SQL注入。



这是它的工作原理： http://xkcd.com/327 。



你明白了吗？从控件中获取的字符串可以是任何东西，包括......一段SQL代码。



怎么办？只需阅读有关此问题和主要补救措施：参数化语句： http://en.wikipedia.org/ wiki / SQL_injection 。



使用ADO.NET，使用：http://msdn.microsoft.com/en-us/library/ff648339.aspx 。



请参阅我过去的答案有更多细节：

在com.ExecuteNonQuery中更新EROR（ ）; ，

嗨名字没有显示在名称中？。

-SA

Please see the comment to the question by Richard Deeming.

Your approach is wrong from the very beginning. The query composed by concatenation with strings taken from UI. Not only repeated string concatenation is inefficient (because strings are immutable; do I have to explain why it makes repeated concatenation bad?), but there is way more important issue: it opens the doors to a well-known exploit called SQL injection.

This is how it works: http://xkcd.com/327.

Are you getting the idea? The string taken from a control can be anything, including… a fragment of SQL code.

What to do? Just read about this problem and the main remedy: parametrized statements: http://en.wikipedia.org/wiki/SQL_injection.

With ADO.NET, use this: http://msdn.microsoft.com/en-us/library/ff648339.aspx.

Please see my past answers for some more detail:
EROR IN UPATE in com.ExecuteNonQuery();,
hi name is not displaying in name?.

—SA

这篇关于[已解决]使用数据列表循环链接按钮和标签的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！