从数据库获取引用的数据时出错 [英] Error on Quoted Data fetch from Database

问题描述

hii，


我有一个问题，当我从数据库中获取数据时，如果在数据库中有一些引用的数据，例如D`DUN.此数据已插入DB中.当我执行选择查询，如:

hii,


i have question that when i fetch data from database and if in the databse have some quoted dat e.g. D`DUN. this data is inserted in DB. when i execute select query like :

      Select city from glmast where glname=''" + list_customer.Items[i].Value + "''

in list_cutomer  there is data in which some data are inserted like D`DUN like quotes. so it gives error like unclosed Quotation. 

so, how this will be solved because not all field contain Quotes.

Please Help Me..
Mitesh

推荐答案

请勿连接字符串以构建SQL命令.它使您对意外或蓄意的SQL注入攻击敞开大门，这可能会破坏整个数据库.请改用参数化查询.

Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

Using con As New SqlConnection(strConnect)
	con.Open()
	Using cmd As New SqlCommand("SELECT city FROM glmast WHERE glname=@GLN", con)
                cmd.Parameters.AddWithValue("@GLN", list_customer.Items[i].Value)
		Using reader As SqlDataReader = cmd.ExecuteReader()
			While reader.Read()
				Console.WriteLine("City: {0}", reader("city"))
			End While
		End Using
	End Using
End Using

这样做也可以解决您的问题...


您可以将此vb代码转换为c#代码吗?"

Doing this will also cure your problem...


"can you caonvert this vb code to c# code ? please"

using (SqlConnection con = new SqlConnection(strConnect))
   {
   con.Open();
   using (SqlCommand cmd = new SqlCommand("SELECT city FROM glmast WHERE glname=@GLN", con))
      {
      cmd.Parameters.AddWithValue("@GLN",list_customer.Items[i].Value);
      using (SqlDataReader reader = cmd.ExecuteReader())
         {
         while (reader.Read())
            {
            Console.WriteLine("City: {0}", reader["city"]));
            }
         }
      }
   }

[edit]固定的C#转换-OriginalGriff [/edit]

[edit]Fixed C# conversion - OriginalGriff[/edit]

这篇关于从数据库获取引用的数据时出错的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！