ODBC数据读取器 - 如何使用ODBC数据读取器命令显示值 [英] ODBC Data Reader- How to show values Using ODBC Data Reader Command

问题描述

朋友我想显示来自MS Access数据库的值，但它显示以下错误：

n在执行当前Web请求期间发生了未处理的异常。请查看堆栈跟踪以获取有关错误及其源自代码的位置的更多信息。



第42行：//执行DataReader并访问数据。

第43行：OdbcDataReader dr = command.ExecuteReader（）;









我有这个代码：

Friends I want to show values from MS Access database, but it is showing following error:
n unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Line 42: // Execute the DataReader and access the data.
Line 43: OdbcDataReader dr = command.ExecuteReader();




I have this code:

string name = Session["name"].ToString();

    using (OdbcConnection connection = new OdbcConnection())
    {
        connection.ConnectionString = "DSN=mydsn";
        connection.Open();
        OdbcCommand command = new OdbcCommand("select * from registration-2 where name= '"+name+"'", con);

        

        // Execute the DataReader and access the data.
        OdbcDataReader dr = command.ExecuteReader();
        while (dr.Read())
        {Label2.Text= dr["name"].ToString();


            
              Label4.Text = dr["qualification"].ToString();

             
              Label5.Text = dr["stream"].ToString();

              Label6.Text = dr["skills"].ToString();

              Label7.Text = dr["email-id"].ToString();

              Label8.Text = dr["about-me"].ToString();
            Label8.Text = dr["objective"].ToString();
            
        }

        // Call Close when done reading.
        dr.Close();
    }
}

推荐答案

减号，我的朋友，减号。

不要在表名中使用它们：SQL假设你的意思是从'注册'减去两个然后混淆......



更改你的表名（推荐）或用方括号括起来：

Minus sign, my friend, minus sign.
Don't use them in table names: SQL assumes you mean "subtract two from 'registration'" and then gets confused...

Either change your table name (recommended) or enclose it in square brackets:

OdbcCommand command = new OdbcCommand("SELECT * FROM [registration-2] WHERE name= '"+name+"'", con);

BTW：不要这样做，特别是如果用户可以选择他们的名字：永远不要连接字符串来构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。请改用参数化查询。

BTW: Don't do it like that, especially if users can pick their names: Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

这篇关于ODBC数据读取器 - 如何使用ODBC数据读取器命令显示值的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！