Question

string date = ddlShowDates.SelectedValue.ToString(); 
cmd = new SqlCommand("SELECT tbl_Shows.ShowTime FROM tbl_Shows INNER JOIN tbl_MovieTimings ON tbl_Shows.ShowId = tbl_MovieTimings.ShowId WHERE tbl_MovieTimings.Date='" + date + "'", con);

我想在下拉列表中显示按日期显示的节目时间。

Answer 1

始终使用sql-parameters而不是字符串连接来阻止sql-injection。

我猜你有第二个DropDownList应该从第一个填充：

DateTime date = DateTime.Parse(ddlShowDates.SelectedValue);
string sql = @"SELECT tbl_Shows.ShowTime 
               FROM tbl_Shows 
               INNER JOIN tbl_MovieTimings 
                   ON tbl_Shows.ShowId = tbl_MovieTimings.ShowId
               WHERE tbl_MovieTimings.Date=@Date";
using(var con = new SqlConnection("ConnectionString"))
using(var cmd = new SqlCommand(sql, con))
{
    cmd.Parameters.Add("@Date", SqlDbType.Date).Value = date;
    con.Open();
    using(var rd = cmd.ExecuteReader())
    {
       while(rd.Read())
       {
           TimeSpan time = rd.GetTimeSpan(0); 
           timeDropDownList.Items.Add(time.ToString());// change format as desired in TimeSpan.ToString
       }
    }
}

根据细节从数据库中获取数据

1 个答案: