Question

嘿大家对SQL数据库函数都很陌生，但已经用c＃编写了大约一年的时间，现在仍然不是那么好但是我到了那里！

我正在创建一个足球应用程序和编辑播放器和匹配我想使用一个下拉组合框从SQL数据库中检索数据，然后填充其他文本框和组合框。我自己也去了，但不知道我哪里出错了。

在表单加载时，我的连接打开，我填充我的数据集并执行此方法以填充我的组合框

private void Navigate()
{
   string showPlayers = "SELECT * From Add_Players";
   SqlCommand cmdData = new SqlCommand(showPlayers, conn);
   SqlDataReader myReader = cmdData.ExecuteReader();

   while (myReader.Read())
   {
      comboEditPlayer.Items.Add(myReader[0]);
   }
   conn.Close();
}

之后在组合框中选择索引改变方法我有这个代码

private void comboEditPlayer_SelectedIndexChanged(object sender, EventArgs e)
{
   try
   {
      conn.Open();
      string showPlayers = "SELECT * From Add_Players WHERE Player_ID ='" 
      + comboEditPlayer + "'   ;";
      SqlCommand cmdData = new SqlCommand(showPlayers, conn);
      SqlDataReader myReader = cmdData.ExecuteReader();

      while (myReader.Read())
      {
         comboEditPlayerPos.Items.Add(myReader[1]);
         txtEditPlayerName.Text = myReader[2].ToString();
         txtEditPlayerSecond.Text = myReader[3].ToString();
         comboEditPlayerStatus.Items.Add(myReader[4]);
      }
      conn.Close();
      conn.Dispose();
   } 
   catch (Exception comboFail)
   {
      MessageBox.Show(comboFail.ToString());
   }
}

我被告知这段代码是开放的，我需要使用参数化查询来防止我已经开始的黑客尝试，但不知道我应该添加到我的代码中的参数是什么？

private void comboEditPlayer_SelectedIndexChanged(object sender, EventArgs e)
{
   string connectionString =
      ZimbFootball.Properties.Settings.Default.Football2ConnectionString;
   using (SqlConnection connection = new SqlConnection (connectionString))
   {
      connection.Open();

      using (SqlCommand command = new SqlCommand(
               "SELECT * From Add_Players WHERE Player_ID =" 
               + comboEditPlayer.SelectedValue + "", connection))
      {
         command.Parameters.Add(new SqlParameter ("",));
      }
   }
}

感谢所有帮助，请轻松告诉我：P

Answer 1

您可以使用ComboBox的值向集合中添加参数，然后执行查询并从阅读器中读回值

private void comboEditPlayer_SelectedIndexChanged(object sender, EventArgs e)
{
      string connectionString =
          ZimbFootball.Properties.Settings.Default.Football2ConnectionString;
      using (SqlConnection connection = new SqlConnection (connectionString))
      using (SqlCommand command = new SqlCommand(
                    "SELECT * From Add_Players WHERE Player_ID =@id", connection))
      {
          connection.Open();
          command.Parameters.AddWithValue("@id", comboEditPlayer.Text);
          using(SqlDataReader myReader = command.ExecuteReader())
          {
              while (myReader.Read())
              {
                    comboEditPlayerPos.Items.Add(myReader[1]);
                    txtEditPlayerName.Text = myReader[2].ToString();
                    txtEditPlayerSecond.Text = myReader[3].ToString();
                    comboEditPlayerStatus.Items.Add(myReader[4]);
              }
          }
       }
 }

如何使用一个组合框使用SQL数据库数据填充文本框

1 个答案: