Question

我试图比较数据库中每次用户登录时更新的值。当我使用给定代码执行查询时，没有任何反应。但是如果我给它一个值say（其中Attempt＆gt; 10）它可以在我错误的地方工作吗？

private void User_Tick(object sender, EventArgs e)
{
    SqlConnection con13 = new SqlConnection("Data Source = *** ")

    SqlDataAdapter SDA2 = new SqlDataAdapter("SELECT [User],[Login],[number1],[number2],[number3],[Alertcount] FROM Users.dbo.[Email] where [Alertcount] = 1 and [Alertcount] !=2", con13);

    DataTable Users = new DataTable();
    DataTable DATA2 = new DataTable();

    SDA2.Fill(DATA2);

    dataGridView2.DataSource = DATA2;

    foreach (DataGridViewRow dr in dataGridView2.Rows)
    {
        string col2 = 1.Cells["User"].Value.ToString();
        string col1 = 1.Cells["Login"].Value.ToString();
        string col3 = 1.Cells["number1"].Value.ToString();
        string col4 = 1.Cells["number2"].Value.ToString();
        string col5 = 1.Cells["number3"].Value.ToString();
        string col6 = 1.Cells["Alertcount"].Value.ToString();

        var mine = Convert.ToInt32(col3);
        var mine2 = Convert.ToInt32(col5);

        SqlConnection CON2 = new SqlConnection("Data Source = ***")
        CON2.Open();

        SqlDataAdapter SDA = new SqlDataAdapter("SELECT [User],[Login],[Attempt] FROM User.dbo.Actions where  [Attempt] >  '"+mine+ "' and [Attempt] < '" + mine2 + "'", CON2);

        DataTable DATA = new DataTable();
        SDA.Fill(DATA);

        dataGridView1.DataSource = DATA;
    }
}

Answer 1

如果列Attempt是一个整数（从Attempt < 10运行的事实可以明显看出），则无需在字符串中将比较值传递给它。所以你的查询应该是这样的：

SqlDataAdapter SDA = new SqlDataAdapter("SELECT [User],[Login],[Attempt] FROM User.dbo.Actions where  [Attempt] >  "+mine+ " and [Attempt] < " + mine2 , CON2);

我建议您以后通过创建查询变量然后在SQL中手动运行查询以查看错误是什么来调试此类错误。你可以这样做：

var query = "SELECT [User],[Login],[Attempt] FROM User.dbo.Actions where  [Attempt] >  "+mine+ " and [Attempt] < " + mine2 ;
SqlDataAdapter SDA = new SqlDataAdapter(query , CON2);

Answer 2

没有任何反应 - 没有足够的信息来获得正确答案。如果实际上没有任何反应，则删除代码周围的所有try catch块并再次运行应用程序。如果出现问题，您将获得有关Exception形式出现问题的非常有用的信息。

然而，问题似乎是您将错误的数据传递给数据库查询始终使用SqlParameter将动态数据传递给查询。 SqlParameter具有您可以设置为要操作的对应列类型的类型。同样SqlParameter将保护您免受SQL注入。

尽可能使用using用于一次性物品（“始终”阅读）

var emailQuery = 
    @"SELECT [User] ,[Login] ,[number1] ,[number2] ,[number3] ,[Alertcount] 
    FROM Users.dbo.[Email] 
    WHERE [Alertcount] = 1 
        AND [Alertcount] !=2"; // Useless condition, because Alertcount already = 1

using(var connection2 = new SqlConnection("Data Source = *** "))
using(var adapter2 = new SqlDataAdapter(emailQuery, connection1))
{
    var data2 = new DataTable();
    adapter2.Fill(data2);
    dataGridView2.DataSource = data2;
}

var actionsQuery = 
    @"SELECT [User] ,[Login] ,[Attempt] 
    FROM User.dbo.Actions 
    WHERE Attempt > @Mine AND Attempt < @Mine2";
foreach (var row in dataGridView2.Rows)
{
    var mine = (int)row.Cells["number1"].Value; // it is already integer, just cast it
    var mine2 = (int)row.Cells["number3"].Value;

    using(var connection1 = new SqlConnection("Data Source = *** "))
    using(var adapter1 = new SqlDataAdapter(actionsQuery, connection1))
    {
        var parameters = new[]
        {
            new SqlParameter
            {
                ParameterName = "@Mine",
                SqlDbType = SqlDbType.Int,
                Value = mine
            },
            new SqlParameter
            {
                ParameterName = "@Mine2",
                SqlDbType = SqlDbType.Int,
                Value = mine2
            }
        };
        adapter1.SelectCommand.Parameters.AddRange(parameters);

        var data1 = new DataTable();
        adapter.Fill(data1);
        dataGridView1.DataSource = data1
    }        
}

SQL值为整数

2 个答案: