c＃mysql连接

Question

你好，我有一个执行问题。

string MyConString = "SERVER=<snip>;" + "DATABASE=<snip>;" + "UID=<snip>;" + "PASSWORD=<snip>;";
MySqlConnection connection = new MySqlConnection(MyConString);
MySqlCommand command = connection.CreateCommand();

command.CommandText = "UPDATE characters SET nobless=1 WHERE char_name=";

connection.Open();
try
{
    command.BeginExecuteNonQuery();
}
catch (Exception ex)
{
    MessageBox.Show(ex.Message);
}
MessageBox.Show("Done");
connection.Close();

command.CommandText = "UPDATE characters SET nobless=1 WHERE char_name="; 

我想：

WHERE char_name = textbox1.text 

例如，我该怎么做？ 例如，如果我做到了：

command.CommandText = "UPDATE characters SET nobless=1 WHERE char_name='hello'"; 

它有效。

但是当我拥有它时：

command.CommandText = "UPDATE characters SET nobless=1 WHERE char_name="+listbox1.selecteditem.toString();

它不起作用，实际上我想将WHERE =设置为一个列表框的选定名称！

Answer 1

使用parameterized query：

command.CommandText = "UPDATE characters SET nobless=1 WHERE char_name= @char_name"
command.Parameters.AddWithValue("@char_name", listbox1.SelectedItem);