Question

我在尝试通过变量（月亮）获取列表框的内容和SQL字符串时遇到问题以下是来自下面代码主体的3个SELECT字符串。最后两个字符串工作正常但第一个没有。那是我尝试将变量放入代码的那个我已经尝试了一些代码的变化，但似乎没有任何工作。任何人都有任何建议。 SQL STRINGS：

            da = New OleDbDataAdapter("SELECT * FROM books WHERE [author] = '" & moon     "' ", myConnection) 'fails
           da = New OleDbDataAdapter("SELECT * FROM books", myConnection) 'works
           da = New OleDbDataAdapter("SELECT * FROM books WHERE author = 'molly brown' ", myConnection) 'works{

主要代码身体

Imports System.Data
Imports System.Data.OleDb
Imports System.Data.Odbc
Imports System.Data.DataTable

Public Class Form1


    Dim provider As String
    Dim dataFile As String
    Dim connString As String
    Dim myConnection As OleDbConnection = New OleDbConnection
    Dim ds As DataSet = New DataSet
    Dim da As OleDbDataAdapter
    Dim tables As DataTableCollection = ds.Tables
    Dim source1 As New BindingSource()



    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Dim moon As String
        moon = ListBox1.Text

        provider = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source ="
        dataFile = "C:\Documents and Settings\james\Desktop\Authors.accdb" ' change to access database location on your computer
        connString = provider & dataFile
        myConnection.ConnectionString = connString
        da = New OleDbDataAdapter("SELECT * FROM books WHERE [author] = '" & moon & "' ", myConnection) 'fails
        'da = New OleDbDataAdapter("SELECT * FROM books", myConnection) 'works
        'da = New OleDbDataAdapter("SELECT * FROM books WHERE author = 'molly brown' ", myConnection) 'works

        da.Fill(ds, "books")

        ' replace "items" with the name of the table
        ' replace [Item Code], [Description], [Price] with the columns headers

        Dim view1 As New DataView(tables(0))
        source1.DataSource = view1
        DataGridView1.DataSource = view1
        DataGridView1.Refresh()

    End Sub


End Class

Answer 1

最佳做法是为每次调用数据库使用一个新的连接对象，定义可能范围最小的对象，并使用参数化查询，而不是将值替换为sql字符串。

在任何情况下都不应该使用字符串操作将用户选择的值放入sql语句中！这样的代码非常糟糕：

da = New OleDbDataAdapter("SELECT * FROM books WHERE [author] = '" & moon  & "' ", myConnection)

想象一下，如果您有像“Patrick O'Neil”这样的作者，本例中会发生什么。有许多方法可以进一步滥用此问题，从而对数据库，应用程序和用户造成实际损害。只是不要使用字符串连接。

请改为：

Public Class Form1

    Private Const provider As String = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source ="
    Private Const dataFile As String = "C:\Documents and Settings\james\Desktop\Authors.accdb" ' change to access database location on your computer
    Private connString As String = provider & dataFile      

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Dim ds As New DataSet()
        'Set a special placeholder for your value as part of a *constant* sql statement
        Dim sql As String = "SELECT * FROM books WHERE [author] = ? "

        Using cn As New OleDbConnection(connString), _
              cmd As New OleDbCommand(sql, cn), _
              da As New OleDbDataAdapter(cmd)

            'Set the value for that placeholder via a query parameter
            'Parameters work best when you set the actual type and length 
            ' to match your database. I had to guess at the length here.
            cmd.Parameters.Add("?", OleDbType.NVarChar, 50).Value = Listbox1.Text
            da.Fill(ds, "books")
        End Using

        DataGridView1.DataSource = ds.Tables("books")
        DataGridView1.Refresh()   
    End Sub   

End Class

从列表框中获取变量到sql字符串

1 个答案: