Question

我希望用户在这里选择他的书籍的搜索条件是代码，建议请!!

String keyword=Textbox1.Text; //User types keyword
String userCriteria=Textbox2.Text;// Can be Title, Author, Subject or ISBN;

String sql="Select * from tableBooks WHERE '"+keyword+"' like '%"+userCriteria+"'%";

如何让用户选择自己的搜索数据库标准？

Answer 1

您当然需要一种更好的方法来构建查询。如果没有特定的检查或过滤措施，您不会直接从用户那里获取输入，并将其放入查询中。这会将您的应用程序暴露给sql注入。使用SQL参数。请尝试此链接作为参考：http://www.dotnetperls.com/sqlparameter

示例：

 using (SqlCommand command = new SqlCommand("Select * from tableBooks WHERE @Field LIKE @Value", connection))
        {
        //
        // Add new SqlParameter to the command.
        //
        command.Parameters.Add(new SqlParameter("Field", Textbox1.Text)); // I do not recommend using a textbox and letting the user write anything. You have to limit his choices by the fields in your table. Use a dropdownlist and limit his choices by meaningful fields in your "tableBooks" table.
        command.Parameters.Add(new SqlParameter("Value", Textbox2.Text));
        //
        // Read in the SELECT results.
        //
        SqlDataReader reader = command.ExecuteReader();
        while (reader.Read())
        {
            //GET YOUR BOOK
        }
        }

请注意我的意见：

//我不建议使用文本框并让用户将任何内容写为“关键字”。您必须通过表格中的列限制他的选择。使用下拉列表并通过“tableBooks”表中有意义的选择限制他的选择。

Answer 2

使用参数化查询比使用的表单更安全你可以试试这个，我认为这会有所帮助

// Declare a connection
            conn =  new 
                SqlConnection("Server=.;DataBase=DataBase;Integrated Security=SSPI");
            conn.Open();

            //Create parameterized query
            SqlCommand cmd = new SqlCommand(
                "Select * from tableBooks WHERE (case @userCriteria when 'Title' then Title when 'Author' then Author when 'Subject' then Subject when 'ISBN' then ISBN else '' end)  LIKE '%'+@keyword+ '%'", conn);
            //Create parameter userCriteria
            SqlParameter param  = new SqlParameter();
            param.ParameterName = "@userCriteria";
            param.Value         = userCriteria;
            //Create parameter keyword
            SqlParameter param  = new SqlParameter();
            param.ParameterName = "@keyword";
            param.Value         = userCriteria;

            // add new parameter to command object
            cmd.Parameters.Add(param);

            // get data stream
            reader = cmd.ExecuteReader();

            // write each record
            while(reader.Read())
            {
                //Get data
            }

库目录搜索sql语句

2 个答案: