Question

我已经在墙上撞了两天了。在ssms

中运行时，此更新语句有效

update dbo.DEMOGRAPHICS 
set ETHNICITY = (select distinct(ethnicity) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = 'P000084716' and ACADEMIC_SESSION != '')
, GENDER = (select distinct(GENDER) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = 'P000084716' and ACADEMIC_SESSION != '')
, MARITAL_STATUS = (select distinct(MARITAL_STATUS) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = 'P000084716' and ACADEMIC_SESSION != '')
, RELIGION = (select distinct(RELIGION) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = 'P000084716' and ACADEMIC_SESSION != '')
, VETERAN = (select distinct(VETERAN) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID =  'P000084716' and ACADEMIC_SESSION != '')
, CITIZENSHIP = (select distinct(CITIZENSHIP) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = 'P000084716'and ACADEMIC_SESSION != '')
,RETIRED = (select distinct(RETIRED) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '000084716' and ACADEMIC_SESSION != '')
, LEGAL_RESIDENCE = (select distinct(LEGAL_RESIDENCE) from dbo.DEMOGRAPHICS where   PEOPLE_CODE_ID = 'P000084716' and ACADEMIC_SESSION != '')
where PEOPLE_CODE_ID = 'P000084716'  and ACADEMIC_SESSION = ''

但在代码中进行更新

string updDemoRecords = @"update dbo.DEMOGRAPHICS 
set ETHNICITY = (select distinct(ethnicity) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
, GENDER = (select distinct(GENDER) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
, MARITAL_STATUS = (select distinct(MARITAL_STATUS) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
, RELIGION = (select distinct(RELIGION) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
, VETERAN = (select distinct(VETERAN) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
, CITIZENSHIP = (select distinct(CITIZENSHIP) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}'and ACADEMIC_SESSION != '')
,RETIRED = (select distinct(RETIRED) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
, LEGAL_RESIDENCE = (select distinct(LEGAL_RESIDENCE) from dbo.DEMOGRAPHICS where PEOPLE_CODE_ID = '{0}' and ACADEMIC_SESSION != '')
where PEOPLE_CODE_ID = '{0}'  and ACADEMIC_SESSION = ''";
updDemoRecords = string.Format(updDemoRecords, peopleOrgCodeID);
pcCon = new SqlConnection(pcConnString);
SqlCommand doUpdDemoRecords = new SqlCommand(updDemoRecords, pcCon);
pcCon.Open();
doUpdDemoRecords.ExecuteNonQuery();
pcCon.Close();

也从存储的proc中尝试它，它也不会更新相关的行。它是sql server 2008和c＃.net

Answer 1

在我看来，您使用的是实际号码（peopleOrgCodeID） - 在SSMS版本（使用字符串）中使用时，这似乎不需要前导0

因此，如果peopleOrgCodeId是一个整数（或长整数）且值为84716，那么您的WHERE子句将最终为：

where PEOPLE_CODE_ID = '84716'

而不是：

where PEOPLE_CODE_ID = '000084716'

您可以使用composite formatting string或使用前导零传入字符串值来解决此问题。

我会提到SQL注入是一个可能的问题，但如果peopleOrgCodeID确实是一个整数，那么在这种情况下你是安全的。不过，我仍然会使用参数化查询而不是string.Format。

update语句在SSMS中有效，但在代码中无效

1 个答案: