帮助更正查询 [英] Help to Correct the query

问题描述

select Sheetno,VehicleNo,EDate,SKM,EKM,TKM,Driver1,Driver2,Cleaner,AdvAmt,Mile,Tfrieght,Trecv,TBal,TEAmt,NetBal from TripSheet where VehicleNo ='" & cb_VehNo.Text & "' and EDate between '" & dtp_Fdate.Value & "' and '" & dtp_Ldate.Value & "'

请问这是正确的还是错误的?....

Plz... Say is this correct or not?....

推荐答案

那是错误的
是的，您是否听说过 SQL注入 [

That''s wrong
Yes, have you heard about SQL injection[^]? Never concatenate strings to for SQL things. Use parametrized queries.

SqlCommand cmd = new SqlCommand("SELECT Sheetno,VehicleNo,EDate,SKM,EKM,TKM,Driver1,Driver2,Cleaner,AdvAmt,Mile,Tfrieght,Trecv,TBal,TEAmt,NetBal FROM TripSheet WHERE VehicleNo =@VehicleNo AND EDate BETWEEN @FromDate AND @ToDate",con);
cmd.Parameters.AddWithValue("@VehicleNo", cb_VehNo.Text);
cmd.Parameters.AddWithValue("@FromDate", dtp_Fdate.Value);
cmd.Parameters.AddWithValue("@ToDate", dtp_Ldate.Value);

有趣的阅读-给我参数化的SQL，否则就死了 [ ^ ]

这是正确的.


希望这会有所帮助，如果是，那么请接受并投票答复.任何对此的任何疑问/问题都将受到欢迎.

谢谢与问候
RDBurmon.Sr.Software Engineer

This is correct.


Hope this helps , If yes then plz accept and vote the answer. Any queries / questions on this are always welcome.

Thanks & Regards
RDBurmon.Sr.Software Engineer

这似乎是正确的.

值得一看的是dtp_Fdate.Value和dtp_Ldate.Value的格式，可以像''yyyyMMdd'' or ''yyyy-MM-dd''.

如 http://msdn.microsoft.com/en-us/library/ms187922.aspx ^ ]查询包括记录Between 条款的From和To日期.

This appears to be correct.

One point to see is the format of dtp_Fdate.Value and dtp_Ldate.Value, which can be like ''yyyyMMdd'' or ''yyyy-MM-dd''.

Further as explained http://msdn.microsoft.com/en-us/library/ms187922.aspx[^] the query includes the records with From and To dates of the Between clause.

这篇关于帮助更正查询的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！