我的asp.net Web服务代码给出错误

时间:2014-04-18 03:57:29

标签: asp.net

你好我已经创建了从表测试中提取年龄的代码 但不是回到年龄,而是返回以下声明

System.Data.SqlClient.SqlDataReader

这是代码

[的WebMethod]

    public string Getcustomername(string name)
    {
        SqlConnection con = new SqlConnection("Data Source=GURJOT;Initial Catalog=TEST;Integrated Security=True");
        SqlCommand com = new SqlCommand();

        com.Connection = con;
        con.Open();
        com.CommandText = "SELECT * from test WHERE Name='" + name + "'";
        SqlDataReader dt = com.ExecuteReader();
        dt.Read();
        con.Close();
        dt.Close();
        return dt.ToString();

任何帮助将不胜感激 感谢

1 个答案:

答案 0 :(得分:1)

您应该返回字段的值,而不是返回dt.ToString()

public string GetCustomerAge(string name)
{
  using (SqlConnection con = new SqlConnection("Data Source=GURJOT;Initial Catalog=TEST;Integrated Security=True"))
  {
    using(SqlCommand com = new SqlCommand())
    { 
      com.Connection = con;
      con.Open();
      com.CommandText = "SELECT age from test WHERE Name='" + name + "'";
      using (SqlDataReader dt = com.ExecuteReader())
      {
        if (dt.Read())
        {
          return System.Convert.ToString(dt.GetValue(0));
        }
      }
  }
  return "";
}

请使用参数化查询 - http://en.wikipedia.org/wiki/SQL_injection